fix(provisioning): two-QR flow — WiFi join + open-browser trigger

User report: iOS sees the captive network correctly (the captive UI
fires the moment any app makes an HTTP request), but won't auto-pop
it from a QR-scan join. This is recent-iOS hardening — Apple no
longer aggressively opens CNA on QR-initiated joins.

Workaround: a single QR can only encode one action, but two QRs
side-by-side close the loop —

  STEP 1 — WiFi-join QR (WIFI:T:WPA;S:NAME;P:pass;;)
           Phone joins PictureFrame.
  STEP 2 — URL QR (http://192.168.4.1/)
           Phone opens Safari → Safari hits 192.168.4.1 → that HTTP
           request is the "any app" trigger that fires the captive
           UI deterministically.

Implementation:
- WiFi QR shrinks from cell 5 (185 px) to cell 4 (148 px) to make
  room for the URL QR below.
- URL QR is static, baked into ap_bg.bin via Python qrcode at gen
  time — no firmware QR-render changes needed for it.
- epd_draw_ap_screen / _retry overlay coords updated to match the
  new WiFi QR position (581, 100, 4).
- Left-panel step list now reads "1. Unlock / 2. Scan QR 1 / 3. Scan
  QR 2 / 4. Enter password and tap Connect".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/panels/waveshare73/v1/epd_driver.cpp

@@ -175,14 +175,14 @@ static void draw_from_lfs(const char* path, uint8_t fallback_color,
 }
 
 void epd_draw_ap_screen(QRCode* qr) {
-    // AP_QR_X=563, AP_QR_Y=185, AP_QR_CELL=5  (must match gen_screens.py)
-    draw_from_lfs("/ap_bg.bin", COLOR_YELLOW, qr, 563, 185, 5);
+    // AP_QR_X=581, AP_QR_Y=100, AP_QR_CELL=4  (must match gen_screens.py)
+    draw_from_lfs("/ap_bg.bin", COLOR_YELLOW, qr, 581, 100, 4);
 }
 
 void epd_draw_ap_screen_retry(QRCode* qr) {
     // Same QR coordinates — only the bg .bin differs (red accents,
     // "Connection Failed — try again" label).
-    draw_from_lfs("/ap_bg_retry.bin", COLOR_RED, qr, 563, 185, 5);
+    draw_from_lfs("/ap_bg_retry.bin", COLOR_RED, qr, 581, 100, 4);
 }
 
 void epd_draw_setup_screen(QRCode* qr) {