feat: add root password reset recovery firmware

[massif-01]

Summary

• Add an app-only root password reset firmware mode.
• Reset only NVS key ts_auth/cred_root to the default root password rm01.
• Keep admin password, network settings, certs, SSH keys, and other NVS data untouched.
• Add a shared auth credential layout component with static ABI checks.
• Add tools/build_root_reset.sh and documentation for OTA/manual serial recovery.

Important Scope

This PR targets password-reset-firmware intentionally. It must not be merged to main until the recovery workflow is explicitly accepted.

Verification

• git diff --check
• ROOT_PASSWORD_RESET_VERSION=9.9.9 ./tools/build_root_reset.sh
• ./tools/build.sh --fresh
• Verified root reset build links only main/root_password_reset_main.c and ts_auth_layout among TianShanOS components.

Release Asset Prepared

• build-root-reset/TianShanOS-RootReset-v9.9.9.bin
• Project version: 9.9.9-root-reset.135335.43be1c
• SHA256: e868636208a9605bc595bc1c4c397535985031a43026d4c128b9a4412d302039