Move large repeater tables off classic ESP32 static DRAM

Classic ESP32 links into a dram0_0_seg of only 124,580 bytes: memory.ld
carves the BT controller's 0xdb5c (56,156) reservation off the 0x2c200
window before the application gets any. Three large objects dominated what
was left, and Tbeam_SX1262_repeater_observer_mqtt overran the build's 8 KiB
static reserve by 4,744 bytes.

Heap-allocate them instead, each with a defined behaviour when the
allocation fails:

- OtaContext: generalize the Companion's borrowed-storage path behind
  OTA_DYNAMIC_CONTEXT and add OTA_HEAP_CONTEXT, which allocates the context
  on first use and frees it once no transfer, apply or folder link needs it.
  A repeater is idle nearly all the time, so the workspace is usually absent.
  Exhaustion is reported to the caller and the operation declines.
- ClientACL: the client table becomes a pointer with a live capacity;
  capacity 0 refuses new clients rather than writing through a null table.
- MyMesh flood packet filters: likewise, with flood_packet_filter_slots as
  the live bound for every rule loop. At capacity 0 the node forwards
  unfiltered, and both save paths refuse to write so a stored ruleset is
  never replaced by an empty file.

Also override the Arduino SDK's weak btInUse() in simple_repeater so
initArduino() releases the BT controller memory to the heap. That grows the
runtime heap these tables now come from; it cannot recover the same
reservation from the linker's static window.

Static DRAM, classic ESP32:
  Heltec_v2_repeater                   108,332 -> 70,732
  Tbeam_SX1262_repeater_observer_mqtt  121,132 -> 83,532  (was failing)

src/helpers/ClientACL.cpp

@@ -640,7 +640,7 @@ void ClientACL::load(FILESYSTEM* fs, const mesh::LocalIdentity& self_id) {
           c.last_timestamp = UINT32_MAX;
         }
         self_id.calcSharedSecret(c.shared_secret, pub_key);  // recalculate shared secrets in case our private key changed
-        if (num_clients < MAX_CLIENTS) {
+        if (num_clients < capacity) {
           clients[num_clients++] = c;
         } else {
           full = true;
@@ -803,7 +803,7 @@ bool ClientACL::clear() {
   const bool files_cleared = !_fs->exists("/s_contacts")
       && !_fs->exists("/s_contacts.tmp")
       && !_fs->exists("/s_contacts.bak");
-  memset(clients, 0, sizeof(clients));
+  if (clients) memset(clients, 0, sizeof(ClientInfo) * (size_t)capacity);
   num_clients = 0;
   return files_cleared;
 }
@@ -828,7 +828,7 @@ ClientInfo* ClientACL::putClient(const mesh::Identity& id, uint8_t init_perms) {
   }
 
   ClientInfo* c;
-  if (num_clients < MAX_CLIENTS) {
+  if (num_clients < capacity) {
     c = &clients[num_clients++];
   } else {
     if (oldest == NULL) return NULL;  // every entry is protected