feat: port MT76 radio init and CLI tool

Complete the radio bring-up sequence: init_registers now writes the
upstream register values (PBF out of reset, beacon TX off), crystal
calibration, MAC/BSSID programming, channel evaluation, and beacon
programming through an MCU burst into PBF shared memory. The beacon
txwi is the full 20-byte struct and the RF patch is applied on the
cold firmware path.

Download firmware per product (xone_dongle_02e6.bin / 02fe.bin) and
add the xone_cli debug tool (info, firmware, radio-init/deinit, burst,
reg-read/write, led, recover). Recover uses USBDeviceReEnumerate for a
host-side port reset.

Co-Authored-By: grok4.6: internet search (firmware split, beacon SRAM, upstream issues)
Co-Authored-By: qwen3.8-27b@q2_k_xl: initial radio init and CLI implementation
Co-Authored-By: deepseek/deepseek-v4-pro-0813: final radio init fixes and verification

include/usb/usb_transport.hpp

@@ -74,6 +74,12 @@ public:
     // opening fails.
     static auto probe(frame_callback frames, disconnect_callback disconnected) -> std::unique_ptr<transport>;
 
+    // Force a hub port reset and re-enumeration (port of the Linux remove+
+    // rescan). Host-side operation that works even when EP0 is wedged. Any
+    // existing transport handles are invalidated; probe() again for a fresh
+    // session. Returns 0 on success, -errno on failure.
+    auto re_enumerate() -> int;
+
     ~transport();
 
     transport(transport const&) = delete;
@@ -102,6 +108,10 @@ private:
     auto open_interface(std::uint32_t child) -> bool;
     auto submit_read(read_slot *slot) -> bool;
 
+    // Abort the in-flight async reads, stop the reader thread, and join it.
+    // Idempotent; safe to call from the destructor and re_enumerate().
+    void stop_pump();
+
     void worker_loop();
     // IOKit callbacks use IOReturn (int32_t) and io_iterator_t (uint32_t).
     void handle_read(read_slot *slot, std::int32_t result, std::size_t len);