firmware: double-buffer the panel + zero-copy decode → ~22 fps ceiling

Per-frame paint cost drops from ~24 ms to ~45 µs (≈500× faster) by
enabling num_fbs=2 on the DPI panel and decoding straight into the
back framebuffer. Measured on the bench:

  before: lock=7us ttfb=370us body=40ms dec=6ms paint=24ms post=35us = ~70ms / ~14fps
  after : lock=7us ttfb=330us body=38ms dec=6ms paint=42us  post=25us = ~45ms / ~22fps

How the win actually lands:
- num_fbs=2 in the esp_lcd_dpi_panel_config_t makes the IDF driver
  allocate two framebuffers and stream from one while we fill the
  other.
- display_back_buffer() returns the inactive fb pointer + its size.
- jpeg_decoder_decode() now accepts a caller-provided destination
  buffer instead of owning its own scratch. http_api passes the panel
  back-fb so the hardware JPEG decoder writes BGR888 pixels straight
  into where the DSI will eventually scan from. Zero memcpy in the
  hot path.
- display_flip_back_buffer() calls esp_lcd_panel_draw_bitmap with the
  fb pointer. Because the buffer is inside the panel's own fb range,
  the IDF driver skips its memcpy and just does a cache writeback +
  swaps cur_fb_index. The actual flip happens on the next vsync,
  asynchronously — the call returns in microseconds.

The remaining ceiling is network body time (~38 ms for ~210 KB JPEGs)
and the hardware decoder (~6 ms). Per-viewport JPEG quality (smaller
files = shorter body) is the next lever; everything firmware-side is
already at or near floor.

Also drop the old static jpeg output scratch + JPEG_DECODER_MAX_OUTPUT_BYTES
constant — nothing references them anymore.

1 files changed, 12 insertions, 7 deletions

diff --git a/main/jpeg_decoder.h b/main/jpeg_decoder.h
index 2ac436d..e8a8504 100644
--- a/main/jpeg_decoder.h
+++ b/main/jpeg_decoder.h
@@ -23,12 +23,17 @@ void jpeg_decoder_unlock(void);
 // JPEG_DECODER_MAX_INPUT_BYTES. Caller fills before calling decode.
 void *jpeg_decoder_input_buffer(void);
 
-// Decode the JPEG sitting in the input buffer. Fills out_bgr888 with a
-// pointer to the decoded 24-bit image (3 bytes/pixel, BGR memory order so
-// the DSI engine + TC358762 + Pi panel render channels correctly) and
-// reports the image's width/height in pixels. The output buffer is owned
-// by the decoder — valid only until the next jpeg_decoder_unlock().
-esp_err_t jpeg_decoder_decode(size_t   jpeg_len,
-                              void   **out_bgr888,
+// Decode the JPEG sitting in the input buffer into the caller-provided
+// out_buf (must be at least out_cap bytes, ≥ 800*480*3 for a full
+// panel-sized frame). Bytes land in BGR memory order so the DSI engine
+// + TC358762 + Pi panel render channels correctly. Reports image
+// width/height in pixels.
+//
+// In the /frame hot path the caller passes display_back_buffer() so
+// the hardware decoder writes pixels straight into the panel's back
+// framebuffer with zero intermediate copies.
+esp_err_t jpeg_decoder_decode(size_t    jpeg_len,
+                              void     *out_buf,
+                              size_t    out_cap,
                               uint16_t *out_width,
                               uint16_t *out_height);