firmware: split stream recv into its own task with 3-buffer ping-pong

handle_client previously ran recv → decode → paint serially on one
FreeRTOS task. The kernel TCP buffer filled during decode+paint
(~6ms), and against the IDF-default 5760-byte window the sender
naturally stop-go-rate-limited to ~consumption. Raising the window
to 65535 (previous experiment) regressed g2g from ~100ms to 17s
growing unbounded — the sender pumped 45+ segments per round into
a kernel buffer the app couldn't drain in time, and there was no
way to skip-oldest on the kernel queue.

This commit decouples recv from decode+paint:

  recv-task:   owns the socket. Reads header + body into one of three
               preallocated PSRAM body buffers. On body complete, swaps
               the just-filled buffer into a 1-deep pending slot and
               picks a free buffer for the next recv. If the slot
               already held a frame (decode is slow), drops oldest in
               place — mirror of the Scrypted-side skip-oldest from
               e5acf93.

  decode-task: waits on a binary semaphore. On signal, claims pending,
               then decodes + paints without holding any shared lock.
               Frees its prior buffer implicitly by overwriting
               s_decode_idx on the next claim.

3 PSRAM body buffers (~3MB of 28MB free) ensure the invariant
{recv_idx, pending_idx, decode_idx} are pairwise distinct without
ever blocking recv. jpeg_decoder.c grew an alloc_input_buffer helper
+ jpeg_decoder_decode now takes an explicit input pointer so the
stream and http_api snapshot paths don't share scratch.

New stats:
- recv_dropped_oldest: per-window count of pending-slot overwrites
- decode_idle_min/avg/max_us: time decode-task spent waiting on signal

Measurement at IDF-default 5760 window, Unifi medium substream:

  before split: recv_avg=32ms recv_max~44ms fps=22-26 (recv blocked
                during 6ms decode+paint; chunk_max capped at 5760)
  after split:  recv_avg=17ms recv_max=18-37ms fps=21-29 steady,
                decode_idle_avg=27-40ms (decode mostly waiting),
                drop_oldest=0, painted at source rate

The bottleneck moved from 'decode+paint serializes recv' to the
wire's own send rate. Bigger windows are now safe (recv-task drains
continuously, can't bury us), but won't add fps until source rate
goes up — that's a separate conversation.

1 files changed, 22 insertions, 8 deletions

diff --git a/main/jpeg_decoder.h b/main/jpeg_decoder.h
index e8a8504..495b1a5 100644
--- a/main/jpeg_decoder.h
+++ b/main/jpeg_decoder.h
@@ -19,20 +19,34 @@ esp_err_t jpeg_decoder_init(void);
 bool jpeg_decoder_try_lock(uint32_t timeout_ms);
 void jpeg_decoder_unlock(void);
 
-// Pointer to the input scratch buffer (PSRAM, DMA-aligned). Capacity =
-// JPEG_DECODER_MAX_INPUT_BYTES. Caller fills before calling decode.
+// Pointer to the built-in input scratch buffer (PSRAM, DMA-aligned).
+// Capacity = JPEG_DECODER_MAX_INPUT_BYTES. Owned by the decoder.
+// http_api's snapshot path fills this and decodes from it. The stream
+// server allocates its own buffers via jpeg_decoder_alloc_input_buffer.
 void *jpeg_decoder_input_buffer(void);
 
-// Decode the JPEG sitting in the input buffer into the caller-provided
-// out_buf (must be at least out_cap bytes, ≥ 800*480*3 for a full
-// panel-sized frame). Bytes land in BGR memory order so the DSI engine
-// + TC358762 + Pi panel render channels correctly. Reports image
-// width/height in pixels.
+// Allocate an additional DMA-aligned PSRAM input buffer suitable for
+// jpeg_decoder_decode. Capacity reported via *out_cap. Returned pointer
+// is owned by the caller and never freed — call once per buffer at
+// init time. NULL on failure.
+//
+// Used by the stream server to maintain a ping-pong ring of body
+// buffers between its recv task and its decode/paint task — recv
+// fills one buffer while decode processes another, no memcpy on
+// handoff.
+void *jpeg_decoder_alloc_input_buffer(size_t *out_cap);
+
+// Decode the JPEG sitting in in_buf into the caller-provided out_buf
+// (must be at least out_cap bytes, ≥ 800*480*3 for a full panel-sized
+// frame). Bytes land in BGR memory order so the DSI engine + TC358762
+// + Pi panel render channels correctly. Reports image width/height
+// in pixels.
 //
 // In the /frame hot path the caller passes display_back_buffer() so
 // the hardware decoder writes pixels straight into the panel's back
 // framebuffer with zero intermediate copies.
-esp_err_t jpeg_decoder_decode(size_t    jpeg_len,
+esp_err_t jpeg_decoder_decode(void     *in_buf,
+                              size_t    jpeg_len,
                               void     *out_buf,
                               size_t    out_cap,
                               uint16_t *out_width,