feat: migrate config management from TOML to FlatBuffers

Config is now loaded at runtime via WebSocket (ConfigCtrlMessage)
instead of from hardcoded TOML files. The emulator starts with no
devices and waits for clients to send configuration.

- Define FlatBuffers schemas: EmulationConfig, ComposeDeviceConfig,
  BaseDeviceConfig with recursive DeviceConfig union
- Rename MemSegment.start → addr (flatcc builder/reader name collision)
- Add ConfigCtrlMessage handler: validates STILL state, walks the
  device tree depth-first, assigns numeric IDs, responds with
  DeviceIdMappingNotif or ConfigLoadError
- Add fb_build_config_device_id_mapping() and fb_build_config_error()
  FlatBuffer builders
- Remove hardcoded device loading from main.c; iterate dynamically
  loaded devices in the exec loop
- Fix double-free: freeConf() already frees the struct itself, remove
  redundant free() calls in config.c and base_device.c
- Fix heap-buffer-overflow in device parseSpecsFromConfig: malloc
  for segment name was missing +1 for the null terminator

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

flatbuffers/control/config_ctrl.fbs

@@ -1,8 +1,10 @@
-// Config change control — WIP.
-// Schema stub; content will be defined when the config-change sub-protocol
-// is specified (requires device-loading control in the protocol first).
+include "config/config.fbs";
+
 namespace hmmmm.ctrl.config_ctrl;
 
+// Client → Server: load a new emulation configuration.
+// Only allowed when the emulator is in STILL state.
+// Completely replaces any previously loaded configuration.
 table ConfigCtrlMessage {
-    // TODO
+    config: hmmmm.config.EmulationConfig;
 }