refactor(core): introduce USE_APPLETS macro

diff --git a/core/SConscript.kernel b/core/SConscript.kernel
index f9623c1d..c2a8c47c 100644
--- a/core/SConscript.kernel
+++ b/core/SConscript.kernel
@@ -43,7 +43,7 @@ FEATURE_FLAGS = {
 }
 
 FEATURES_WANTED = [
-    "applet",
+    "applets",
     "ble",
     "consumption_mask",
     "display",
diff --git a/core/SConscript.unix b/core/SConscript.unix
index df00e9f5..cb10f2bf 100644
--- a/core/SConscript.unix
+++ b/core/SConscript.unix
@@ -33,7 +33,7 @@ if BENCHMARK and PYOPT != '0':
   exit(1)
 
 FEATURES_WANTED = [
-    "applet",
+    "applets",
     "ble",
     "display",
     "dma2d",
diff --git a/core/embed/sec/secure_aes/inc/sec/secure_aes.h b/core/embed/sec/secure_aes/inc/sec/secure_aes.h
index cd2408fe..c6fc2fc8 100644
--- a/core/embed/sec/secure_aes/inc/sec/secure_aes.h
+++ b/core/embed/sec/secure_aes/inc/sec/secure_aes.h
@@ -21,7 +21,7 @@
 
 #include <trezor_types.h>
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 #include <sys/applet.h>
 #endif
 
@@ -38,7 +38,7 @@ secbool secure_aes_init(void);
 
 // Sets the applet to be used for AES operation
 // with unprivileged key (XORK_SN).
-#ifdef KERNEL
+#ifdef USE_APPLETS
 void secure_aes_set_applet(applet_t* applet);
 #endif
 
diff --git a/core/embed/sec/secure_aes/stm32u5/secure_aes.c b/core/embed/sec/secure_aes/stm32u5/secure_aes.c
index 50914525..3986847b 100644
--- a/core/embed/sec/secure_aes/stm32u5/secure_aes.c
+++ b/core/embed/sec/secure_aes/stm32u5/secure_aes.c
@@ -73,7 +73,7 @@ static secbool is_key_supported(secure_aes_keysel_t key) {
 secbool secure_aes_ecb_encrypt_hw(const uint8_t* input, size_t size,
                                   uint8_t* output, secure_aes_keysel_t key) {
 #if NORCOW_MIN_VERSION <= 5
-#ifdef KERNEL
+#ifdef USE_APPLETS
   if (key == SECURE_AES_KEY_XORK_SN) {
     return secure_aes_unpriv_encrypt(input, size, output, key);
   }
diff --git a/core/embed/sec/secure_aes/stm32u5/secure_aes_unpriv.c b/core/embed/sec/secure_aes/stm32u5/secure_aes_unpriv.c
index 1a95fa79..c753d1ce 100644
--- a/core/embed/sec/secure_aes/stm32u5/secure_aes_unpriv.c
+++ b/core/embed/sec/secure_aes/stm32u5/secure_aes_unpriv.c
@@ -106,7 +106,7 @@ __attribute((no_stack_protector)) void saes_unpriv_callback(void) {
 // -----------------------------------------------------------------------
 // Code running privileged mode
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 #include <sys/coreapp.h>
 #include <sys/mpu.h>
@@ -182,4 +182,4 @@ secbool secure_aes_unpriv_encrypt(const uint8_t *input, size_t size,
 
   return retval;
 }
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/syscall/inc/sys/syscall_ipc.h b/core/embed/sys/syscall/inc/sys/syscall_ipc.h
index bb3b6379..8c9e0424 100644
--- a/core/embed/sys/syscall/inc/sys/syscall_ipc.h
+++ b/core/embed/sys/syscall/inc/sys/syscall_ipc.h
@@ -19,7 +19,7 @@
 
 #pragma once
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 #include <trezor_types.h>
 
@@ -43,4 +43,4 @@ void syscall_ipc_enqueue(uint32_t* args, syscall_number_t syscall);
 // function is intended to be called from the kernel event loop.
 void syscall_ipc_dequeue(void);
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/syscall/stm32/syscall_context.c b/core/embed/sys/syscall/stm32/syscall_context.c
index 82bdae51..f0d70f66 100644
--- a/core/embed/sys/syscall/stm32/syscall_context.c
+++ b/core/embed/sys/syscall/stm32/syscall_context.c
@@ -19,7 +19,7 @@
 
 #include "syscall_context.h"
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 applet_t* g_syscall_context;
 
@@ -27,4 +27,4 @@ void syscall_set_context(applet_t* applet) { g_syscall_context = applet; }
 
 applet_t* syscall_get_context(void) { return g_syscall_context; }
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/task/applet.c b/core/embed/sys/task/applet.c
index 167029cb..ebe56f18 100644
--- a/core/embed/sys/task/applet.c
+++ b/core/embed/sys/task/applet.c
@@ -23,7 +23,7 @@
 #include <sys/sysevent_source.h>
 #include <sys/systask.h>
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 void applet_init(applet_t* applet, const applet_privileges_t* privileges,
                  applet_unload_cb_t unload_cb) {
@@ -65,4 +65,4 @@ applet_t* applet_active(void) {
   return (applet_t*)task->applet;
 }
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/task/inc/sys/applet.h b/core/embed/sys/task/inc/sys/applet.h
index d9598771..d3a0e44d 100644
--- a/core/embed/sys/task/inc/sys/applet.h
+++ b/core/embed/sys/task/inc/sys/applet.h
@@ -21,7 +21,7 @@
 
 #include <trezor_types.h>
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 #include <sys/systask.h>
 
@@ -99,4 +99,4 @@ bool applet_is_alive(applet_t* applet);
  */
 applet_t* applet_active(void);
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/task/stm32/coreapp.c b/core/embed/sys/task/stm32/coreapp.c
index bdbe3a56..966681b1 100644
--- a/core/embed/sys/task/stm32/coreapp.c
+++ b/core/embed/sys/task/stm32/coreapp.c
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 #include <trezor_model.h>
 #include <trezor_rtl.h>
@@ -160,4 +160,4 @@ mpu_area_t coreapp_get_tls_area(void) { return coreapp_tls_area; }
 
 void* coreapp_get_api_getter(void) { return coreapp_api_getter; }
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/task/stm32/systask.c b/core/embed/sys/task/stm32/systask.c
index 690b1392..0598181d 100644
--- a/core/embed/sys/task/stm32/systask.c
+++ b/core/embed/sys/task/stm32/systask.c
@@ -190,14 +190,14 @@ bool systask_init(systask_t* task, uint32_t stack_base, uint32_t stack_size,
 
 systask_id_t systask_id(const systask_t* task) { return task->id; }
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 void systask_set_mpu(systask_t* task) {
   if (task->applet != NULL) {
     applet_t* applet = (applet_t*)task->applet;
     mpu_set_active_applet(&applet->layout);
   }
 }
-#endif  // KERNEL
+#endif  // USE_APPLETS
 
 uint32_t* systask_push_data(systask_t* task, const void* data, size_t size) {
   if (task->sp < task->sp_lim) {
@@ -227,7 +227,7 @@ void systask_pop_data(systask_t* task, size_t size) { task->sp += size; }
 
 bool systask_push_call(systask_t* task, void* entrypoint, uintptr_t arg1,
                        uintptr_t arg2, uintptr_t arg3) {
-#ifdef KERNEL
+#ifdef USE_APPLETS
   systask_set_mpu(task);
 #endif
 
@@ -321,7 +321,7 @@ void systask_set_r0r1(systask_t* task, uint32_t r0, uint32_t r1) {
     stack += 8;   // Skip R4-R11
   }
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
   systask_set_mpu(task);
 #endif
 
@@ -583,7 +583,7 @@ __attribute((no_stack_protector, used)) static uint32_t scheduler_pendsv(
   prev_task->mpu_mode = mpu_get_mode();
 
   if (prev_task->tls_size != 0) {
-#ifdef KERNEL
+#ifdef USE_APPLETS
     systask_set_mpu(prev_task);
 #endif
 
@@ -609,7 +609,7 @@ __attribute((no_stack_protector, used)) static uint32_t scheduler_pendsv(
   // Setup the MPU for the new task
   mpu_reconfig(next_task->mpu_mode);
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
   systask_set_mpu(next_task);
 
   if (next_task->tls_size != 0) {
@@ -726,7 +726,7 @@ __attribute__((no_stack_protector, used)) static uint32_t svc_handler(
       // Yield to the waiting task
       systask_yield();
       break;
-#ifdef KERNEL
+#ifdef USE_APPLETS
     case SVC_SYSCALL:
       uint32_t args[6] = {stack[0], stack[1], stack[2], stack[3], r4, r5};
       if ((r6 & SYSCALL_THREAD_MODE) != 0) {
diff --git a/core/embed/sys/task/stm32/system.c b/core/embed/sys/task/stm32/system.c
index 5e6cbebc..f49f49c1 100644
--- a/core/embed/sys/task/stm32/system.c
+++ b/core/embed/sys/task/stm32/system.c
@@ -69,10 +69,10 @@ void system_init(systask_error_handler_t error_handler) {
   systask_scheduler_init(error_handler);
   systick_init();
   systimer_init();
-#ifdef KERNEL
 #ifdef USE_IPC
   ipc_init();
 #endif
+#ifdef USE_APPLETS
   syscall_ipc_init();
 #endif
 #ifdef USE_DBG_CONSOLE
diff --git a/core/embed/sys/task/sysevent.c b/core/embed/sys/task/sysevent.c
index a0431527..ec28c62d 100644
--- a/core/embed/sys/task/sysevent.c
+++ b/core/embed/sys/task/sysevent.c
@@ -29,7 +29,7 @@
 #include <sys/systask.h>
 #include <trezor_bsp.h>
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 #include <sys/applet.h>
 #endif
 
@@ -269,7 +269,7 @@ void sysevents_poll(const sysevents_t *awaited, sysevents_t *signalled,
       if (ready || timed_out) {
         events_processed = true;
         systask_t *task = poller->task;
-#if defined(KERNEL) && !defined(TREZOR_EMULATOR)
+#ifdef USE_APPLETS
         systask_set_mpu(task);
 #endif
         if (poller->signalled_arg != NULL) {
diff --git a/core/embed/sys/task/unix/coreapp.c b/core/embed/sys/task/unix/coreapp.c
index 9286f7f0..8930f920 100644
--- a/core/embed/sys/task/unix/coreapp.c
+++ b/core/embed/sys/task/unix/coreapp.c
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifdef KERNEL
+#ifdef USE_APPLETS
 
 #include <trezor_rtl.h>
 
@@ -57,4 +57,4 @@ bool coreapp_init(applet_t* applet, int argc, char** argv) {
 void* coreapp_get_api_getter(void) { return (void*)coreapp_api_get; }
 #endif
 
-#endif  // KERNEL
+#endif  // USE_APPLETS
diff --git a/core/embed/sys/task/unix/systask.c b/core/embed/sys/task/unix/systask.c
index 481b3bdb..594cd740 100644
--- a/core/embed/sys/task/unix/systask.c
+++ b/core/embed/sys/task/unix/systask.c
@@ -84,6 +84,10 @@ systask_t* systask_kernel(void) {
 
 systask_id_t systask_id(const systask_t* task) { return task->id; }
 
+#ifdef USE_APPLETS
+void systask_set_mpu(systask_t* task) {}
+#endif
+
 static uint32_t invoke_pushed_fn_call(systask_t* task) {
   systask_fn_call_t call = task->pushed_fn_call;
 
diff --git a/core/site_scons/models/stm32f4_common.py b/core/site_scons/models/stm32f4_common.py
index 03c52c02..4dfa1c03 100644
--- a/core/site_scons/models/stm32f4_common.py
+++ b/core/site_scons/models/stm32f4_common.py
@@ -98,16 +98,19 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/syscall/stm32/syscall_probe.c",
         "embed/sys/syscall/stm32/syscall_stubs.c",
         "embed/sys/syscall/stm32/syscall_verifiers.c",
-        "embed/sys/task/stm32/coreapp.c",
         "embed/sys/task/stm32/systask.c",
         "embed/sys/task/stm32/system.c",
         "embed/sys/time/stm32/systick.c",
         "embed/sys/time/stm32/systimer.c",
-        "embed/sys/task/applet.c",
         "embed/sys/task/sysevent.c",
         "embed/sys/task/system.c",
     ]
 
+    if "applets" in features_wanted:
+        sources += ["embed/sys/task/applet.c"]
+        sources += ["embed/sys/task/stm32/coreapp.c"]
+        defines += [("USE_APPLETS", "1")]
+
     if "dbg_console" in features_wanted:
         sources += [
             "embed/sys/dbg/dbg_console.c",
diff --git a/core/site_scons/models/stm32u5_common.py b/core/site_scons/models/stm32u5_common.py
index b8c557f0..2b8268af 100644
--- a/core/site_scons/models/stm32u5_common.py
+++ b/core/site_scons/models/stm32u5_common.py
@@ -169,9 +169,10 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         defines += [("USE_IPC", "1")]
         paths += ["embed/sys/ipc/inc"]
 
-    if "applet" in features_wanted:
+    if "applets" in features_wanted:
         sources += ["embed/sys/task/applet.c"]
         sources += ["embed/sys/task/stm32/coreapp.c"]
+        defines += [("USE_APPLETS", "1")]
 
     if "app_loading" in features_wanted:
         sources += ["embed/io/app_loader/stm32/elf_loader.c"]
diff --git a/core/site_scons/models/unix_common.py b/core/site_scons/models/unix_common.py
index 62ad1baa..799fe59e 100644
--- a/core/site_scons/models/unix_common.py
+++ b/core/site_scons/models/unix_common.py
@@ -99,9 +99,10 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         defines += [("USE_IPC", "1")]
         paths += ["embed/sys/ipc/inc"]
 
-    if "applet" in features_wanted:
+    if "applets" in features_wanted:
         sources += ["embed/sys/task/applet.c"]
         sources += ["embed/sys/task/unix/coreapp.c"]
+        defines += [("USE_APPLETS", "1")]
 
     if "app_loading" in features_wanted:
         sources += ["embed/io/app_loader/unix/elf_loader.c"]