fix: protocol 2 core review findings

From the review of #99:
- A sync could stall when a client took a slot the moment another left:
  loop() used up the new client's sync on the old one. The slots move
  to ProtoSlots, a pure module with native tests, and loop() takes a
  slot's wants only for the client it read (takeWants).
- Deleting a group sends its shades, whose inGroup changed. Deleting a
  shade unlinks it from its groups and sends them, so a new shade given
  its id doesn't join them.
- next and sync with an id get an ok reply, and a message in pieces
  gets one bad request, not one per piece.
- Feeds check for loop() before they write the event buffer, and log
  an event too large, as events do.
- editChanges() (ModelEditor, native tests) says what clients get after
  an edit; the edit result carries the shade a group gained or lost.
  order() takes a sort_list_t.
- The frame writers move to ProtoFrame. Renames: pf to proto_field_t,
  the X-macro letters to TYPE/FIELD/ERR/FEED, proto_request_t to
  proto_message_t, REQ_* to WANTS_*, fmt to eventJson. The event
  bodies share sendItem(), the connection type name lives in
  ESPNetwork, and the loop() task check in SocketEmitter.
- e2e: the heap floor check skips when the low since boot is already
  under it; tests for replies to next and sync and a long message.
- SECURITY_PLAN.md splits step 1 into 1a-1d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ProtoFrame.h

@@ -0,0 +1,20 @@
+#ifndef PROTO_FRAME_H
+#define PROTO_FRAME_H
+#include <stdint.h>
+#include "JsonFormatter.h"
+#include "ProtoSchema.h"
+
+// The envelope of every socket protocol 2 frame, and the frames that hold
+// nothing of the shade model (docs/PROTOCOL.md).  Kept free of the shade model
+// and the web server so it can be unit tested on the PC (pio test -e native).
+
+// A frame: {"v":2,"t":<type>,"id":<id>,"d":{ ... }}.  id 0 leaves it out.
+void beginFrame(JsonFormatter &json, proto_type_t type, uint32_t id = 0);
+void endFrame(JsonFormatter &json);
+// A reply that says ok.
+void writeOkReply(JsonFormatter &json, uint32_t id);
+// A reply carrying an error.
+void writeErrorReply(JsonFormatter &json, uint32_t id, proto_error_t code, const char *desc);
+// hello: the firmware version and the schema hash.
+void writeHello(JsonFormatter &json, const char *fw);
+#endif