feat: migrate config management from TOML to FlatBuffers

Config is now loaded at runtime via WebSocket (ConfigCtrlMessage)
instead of from hardcoded TOML files. The emulator starts with no
devices and waits for clients to send configuration.

- Define FlatBuffers schemas: EmulationConfig, ComposeDeviceConfig,
  BaseDeviceConfig with recursive DeviceConfig union
- Rename MemSegment.start → addr (flatcc builder/reader name collision)
- Add ConfigCtrlMessage handler: validates STILL state, walks the
  device tree depth-first, assigns numeric IDs, responds with
  DeviceIdMappingNotif or ConfigLoadError
- Add fb_build_config_device_id_mapping() and fb_build_config_error()
  FlatBuffer builders
- Remove hardcoded device loading from main.c; iterate dynamically
  loaded devices in the exec loop
- Fix double-free: freeConf() already frees the struct itself, remove
  redundant free() calls in config.c and base_device.c
- Fix heap-buffer-overflow in device parseSpecsFromConfig: malloc
  for segment name was missing +1 for the null terminator

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

inc/proto/msg.h

@@ -57,4 +57,14 @@ uint8_t* fb_build_stream_reg_confirm(
     uint32_t device_id, uint32_t seg_id, uint32_t offset, uint32_t length,
     uint8_t mode, size_t* len_out);
 
+// Build a ServerMessage{CtrlServerMessage{ConfigNotifMessage{DeviceIdMappingNotif}}} frame.
+// paths: array of NULL-terminated string arrays; path_lens: component count per path.
+uint8_t* fb_build_config_device_id_mapping(
+    uint64_t nonce,
+    char** paths[], size_t path_lens[],
+    size_t device_count, size_t* len_out);
+
+// Build a ServerMessage{CtrlServerMessage{ConfigNotifMessage{ConfigLoadError}}} frame.
+uint8_t* fb_build_config_error(uint64_t nonce, const char* message, size_t* len_out);
+
 #endif // __PROTO_MSG_H__