BitBox02 firmware

Add bitbox03-boot1

Add bitbox03-boot0

Add bitbox-platform-stm32u5 and stm32u5-sys

cleanup: remove unused crate

lvgl-sys: remove cmake build

Build LVGL directly with cc from an explicit source list and drop the
cmake crate dependency. Use the shared bitbox-lvgl-sys lv_conf.h for the
BB03 graphical simulator and remove the simulator-specific duplicate
config.

Remove cross compilation support in lvgl-sys for now.

tooling: Move rust tools out of dockerfile

It is easier to install the right tools if you aren't using docker.

build: run vendoring script from src/rust

Run rust vendorings script from src/rust so that the correct rust
toolchain is picked up.

payment_request: derive validation addresses once

test: assert payment request securechip counts

keystore: consolidate xpub compute mode

da14531: restore BLE UART backpressure

ListBackups returns one protobuf containing all SD card backups. With many backups, the response spans many 64-byte HWW/U2FHID reports. USB sends those reports directly over HID, but BLE first serial-frames each report for the DA14531 and queues the escaped bytes in the fixed-size UART ByteQueue.

The Rust ByteQueue port kept the panicking single-byte put() API and the BLE poller used it for every framed byte. That removed the previous v9.25 backpressure behavior: da14531_protocol_poll() consumed the pending HWW report before knowing whether the whole framed BLE packet fit in the 2048-byte UART queue. If ListBackups produced data faster than UART drained it, put() eventually hit capacity and panicked with bytequeue overflow. USB does not use this UART queue, which is why the same request worked there.

Add ByteQueue::try_put_slice() plus an extern C wrapper that takes util::Bytes and performs an all-or-nothing enqueue. The BLE HWW path now formats the 64-byte report into a temporary serial frame and only clears hww_data after try_put_slice() succeeds. If the queue is full, it returns without writing any bytes, preserving frame boundaries and leaving the same report pending for the next poll after UART has drained.

Keep the existing panicking put() behavior for the other bytequeue callers so the change stays scoped to the actual backpressure boundary. The separate Rust and extern-wrapper tests cover successful writes and failed overflow attempts being atomic.

AGENTS: run make commands serially

Otherwise the dev-machine can easily lock up.

optiga: fix detached buffer reuse

The Optiga C API keeps raw pointers to the Rust wrapper's static
buffers until the asynchronous callback completes. The Rust wrapper
has a Detached state for futures that were dropped after launching a
command, but the individual wrappers initialized their per-operation
static buffers before calling begin_async_op().

That meant a repeated call to the same wrapper could clear or
overwrite the exact static storage still owned by the detached C
command before begin_async_op() noticed the Detached state and waited
for the old callback.

Move begin_async_op().await before every static buffer or length-cell
mutation. Detached operations are now reclaimed before any static
storage is reused, and live concurrent operations still panic before
their buffers can be corrupted.

bitbox-lvgl-sys/build.rs: remove warning

Agents feel the urge to fix it.

clippy: warn for large futures

Large async state machines keep their captured data alive across await
points. That can silently bloat task allocations and stack usage, which
is especially risky on memory-constrained embedded targets and makes
regressions harder to spot in review.

Add the Clippy lint so oversized futures are flagged early instead of
only showing up later as memory pressure or failures.

Reference: https://rust-lang.github.io/rust-clippy/master/index.html#large_futures

Disable Rust Debug formatting

Pass `-Zfmt-debug=none` in the firmware Rust build.

According to
clippy::no_debug (https://rust-lang.github.io/rust-clippy/master/index.html?search=use_debug):

> It should not be used in user-facing output

This tells rustc not to emit normal `Debug` formatter implementations into
the cross-compiled firmware image. The option also makes `{:?}` print
nothing, so app-visible error status messages must not rely on derived
`Debug`.

Keep the live keystore and backup error status screens explicit by formatting
those errors through small match-based helpers instead of `Debug`. This
preserves the visible diagnostic strings while still allowing derived Debug
formatting to be compiled out of the firmware.

There are still live library `Debug` formatting paths in a no-flag build even
when our callers map those errors to `InvalidInput`. Protobuf and Miniscript
parsers construct detailed errors internally before the caller discards them,
for example `WireType` decode errors and Miniscript `NonTopLevel(format!("{:?}",
...))` errors. `fmt-debug=none` prevents those detailed `Debug` formatters and
their generic formatting helpers from being linked.

Savings: 6464 bytes

Enable blake2 size_opt

The blake2 crate exposes a size_opt feature that trades aggressive
inlining for a smaller implementation. In this firmware build the
Blake2b compression path was still one of the largest Rust code
contributors, so this is a direct ROM for speed trade that matches the
current goal.

Enable size_opt for the existing optional dependency. The algorithm,
test vectors, and call sites stay the same; only the crate internal
code generation strategy changes.

In the resulting image, the large Blake2b compression routine is split
into much smaller outlined helpers instead of one heavily inlined
body. That is where the ROM reduction comes from.

Saves 11576 bytes in firmware.bin.

mbedtls: use RAM instead of ROM to shrink size

Saves 2104 bytes.

Shrink mbedtls SHA256 core

Enable MBEDTLS_SHA256_SMALLER in the Optiga Trust M mbedTLS
user config.

This keeps the same SHA256 and HMAC-SHA256 behavior, but switches
mbedTLS to its smaller SHA256 implementation for the live Optiga
crypto path.

Savings: 1392 bytes.

The main win is that mbedtls_internal_sha256_process shrinks by
1396 bytes in the final image. The surrounding PAL, HMAC, and CCM
entry points remain live, so this is a pure ROM-for-speed tradeoff
rather than a functionality change.

Shrink mbedtls AES tables

Enable MBEDTLS_AES_FEWER_TABLES in the Optiga Trust M mbedTLS
user config.

This keeps the same AES/CCM functionality, but trades a small
amount of AES speed for smaller ROM usage by deriving the extra
AES lookup tables from FT0/RT0 instead of keeping all eight
tables in flash.

- savings: 6208 bytes

The main win is that six live 1024-byte AES tables drop out of
the final image: FT1, FT2, FT3, RT1, RT2, and RT3. FT0 and RT0
remain, and the AES encrypt/decrypt functions shrink slightly as
well.

No functionality changes are intended; this is a ROM-for-speed
tradeoff in the mbedTLS AES implementation used by the Optiga
Trust M integration.

Shrink secp256k1 callbacks

Override libsecp256k1's default callbacks with tiny local stubs.

The vendored callbacks print an error and then call abort(). In the
firmware image those failure-only paths pull in a large chunk of newlib
stdio and signal handling even though the callbacks are only used for
fatal illegal-argument and internal-consistency failures and must never
return.

Saved: 2672 bytes

The final linked image drops the abort/stdio path retained only by those
callbacks, including the public symbols abort, raise, _raise_r,
_kill_r, _getpid_r, fprintf, printf, and _vfprintf_r. It also drops the
private stdio helpers behind them, such as __sfputc_r, __sfputs_r,
__swsetup_r, __swbuf_r, _fflush_r, _fwalk_sglue, __swhatbuf_r,
__swrite, __sread, __sseek, __sclose, __sinit, and __smakebuf_r.
Meanwhile secp256k1_default_illegal_callback_fn and
secp256k1_default_error_callback_fn shrink from 28 bytes each to 2
bytes each.

This keeps the relevant behavior intact: both callbacks still trap the
firmware in a non-returning fatal path, but without dragging in unused
diagnostic formatting code.

drop unneeded -mlong-calls

Firmware builds for Cortex-M4 in Thumb mode, where direct BL calls
reach roughly +/-16 MiB. The firmware image is well within that range,
so forcing -mlong-calls only bloats call sites and C code built
through Rust build scripts.

Remove -mlong-calls from the cross-compilation C flags and from
CARGO_C_FLAGS so the compiler can emit direct calls again.

This saves 11432 bytes in firmware.bin.

optiga: inline async launches

Each Optiga async wrapper currently goes through a generic async
helper that accepts a per-call launch closure. That shape is expensive
in firmware builds: every distinct closure type causes another
monomorphized async state machine, along with duplicate drop glue and
wrapper-specific launch/wait/cleanup control flow.

Inline the Optiga C launch in each wrapper instead and keep only a
non-generic shared wait/cleanup helper. The async behavior does not
change: begin_async_op()/AsyncOpGuard still owns the shared static
buffers, Detached recovery still prevents buffer reuse after
cancellation, and all zeroization and length checks remain in place.

This saves about 1400 bytes in the firmware binary because the
compiler no longer needs to materialize a separate future for each
Optiga operation wrapper just to carry a different launch closure. The
launch step becomes plain local code in each wrapper, while the common
polling and cleanup path stays shared in one non-generic async helper.

optiga: remove unused interface bits

securechip: port U2F counter ops