system/nxpkg: Add network sync and harden package lifecycle.

[aviralgarg05]

Note: Please adhere to Contributing Guidelines.

Summary

Complete the network and package-lifecycle work started by #3474.

This adds:

• catalog synchronization and artifact downloads through
  netutils/webclient;
• SHA-256 verification of downloaded artifacts;
• sync, available, update, remove, and rollback commands;
• failure cleanup and stale-lock reclamation;
• serialized catalog and installed-database updates, with live-owner records
  that do not depend on filesystem timestamp accuracy;
• validation of repository-provided paths, sizes, installed metadata, and
  version fields;
• an optional package icon and installed-manifest loading for graphical
  frontends; and
• support for custom boards where CONFIG_ARCH_BOARD is not defined.

The synchronized catalog records its source in the same atomically replaced
file. This keeps relative artifact resolution consistent with the catalog
under concurrent synchronization. The previous repo.url sidecar is still
read for migration from development images.

User documentation is in apache/nuttx#18875. #3643 is the graphical frontend
that depends on the APIs added here.

Impact

• New feature: YES. nxpkg gains repository synchronization and the
  install/update/remove/rollback lifecycle described above.
• User adaptation: YES when persistence is required. The default root is
  /var/lib/nxpkg; boards must mount persistent storage there or override
  CONFIG_SYSTEM_NXPKG_ROOT.
• Build: YES only for configurations enabling the new network operations;
  they use the selected netutils/webclient HTTP/TLS facilities.
• Hardware: NO architecture or driver change.
• Documentation: YES; provided by Documentation: Update nxpkg and add nxstore guide. nuttx#18875.
• Security: YES. SHA-256 detects artifact corruption or substitution relative
  to the downloaded catalog, but is not package signing. Plain HTTP does not
  authenticate the repository.
• Compatibility: Existing configurations with CONFIG_SYSTEM_NXPKG disabled
  are unaffected. The legacy repo.url sidecar remains readable for
  migration.
• Other: system/nxstore: Add LVGL touchscreen app-store frontend. #3643 is stacked on this PR and must be rebased when this branch is
  rewritten.

Testing

Build host:

• macOS 26.5, arm64
• xtensa-esp-elf-gcc 14.2.0
  (esp-14.2.0_20251107)

Target:

• Xtensa / ESP32-S3
• Waveshare ESP32-S3-Touch-LCD-7 custom configuration

Verification:

• nxstyle on all changed C sources
• git diff --check
• all system/nxpkg sources cross-compiled for ESP32-S3
• all system/nxpkg sources compiled in the simulator configuration
• the complete ESP32-S3 firmware linked and was flashed successfully
• the board loaded and parsed all eight manifests from the cached SD catalog
• an offline SD-card repository completed sync, install, update, reset
  persistence, rollback, remove, and relative-artifact execution
• two concurrent 968,304-byte installs preserved the live package lock and
  committed exactly one install
• a live synchronization lock was retained and the contender returned
  -EBUSY
• dead-task and previous-boot lock records were reclaimed
• a bad SHA-256 install left no database entry, version directory, lock, or
  transaction file

Testing logs before change:

N/A: the synchronization and complete lifecycle commands are new in this PR;
there is no equivalent operation on the PR base to reproduce.

Testing logs after change:

These are the nxpkg diagnostic lines observed on the target, grouped by
check. They are not one continuous console session: the checks were run
separately.

Catalog load and parse:

nxpkg: info: loading index from /mnt/sdcard/nxpkg/index.jsn
nxpkg: info: index read complete (3595 bytes)
nxpkg: info: cJSON_Parse returned success
nxpkg: info: parsed manifest nxdoom 1

Install, update, rollback and remove:

nxpkg: info: synced package index from /mnt/sdcard/nxpkg/audit/v1.jsn
nxpkg: info: installed auditpkg version 1
nxpkg: info: synced package index from /mnt/sdcard/nxpkg/audit/v2.jsn
nxpkg: info: installed auditpkg version 2
auditpkg current=2 previous=1 type=elf arch=xtensa compat=esp32s3-touch-lcd-7 versions=1,2
nxpkg: info: rolled back auditpkg to version 1
nxpkg: info: removed auditpkg

Lock contention and reclaim:

nxpkg: error: unable to acquire package lock for 'locktest': -16
nxpkg: error: unable to acquire sync lock: -16
nxpkg: error: reclaiming lock from exited task 999
nxpkg: error: reclaiming lock from an earlier boot

Checksum rejection, which left behind no database entry, version directory,
lock or transaction file:

nxpkg: error: sha256 mismatch: -84

The lifecycle transcript above was captured against a repository served from
the SD card, which exercises the same pkg_sync()/pkg_install() paths that
the HTTP source feeds. The HTTP transport itself has been exercised on this
board through the companion store frontend, which synchronizes its catalog
over Wi-Fi at boot; I can attach a dedicated nxpkg sync http://... transcript
on request.

PR verification Self-Check

• This PR introduces only one functional change.
• I have updated all required description fields above.
• I have reviewed and signed every rewritten commit.
• I have attached complete before/after real-hardware runtime logs.
• This PR adheres to the current contribution and coding guidelines.
• My PR is still work in progress.
• My PR is ready for review and can be safely merged.

[aviralgarg05]

Rebased onto current master (2aebae740) and squashed to a single commit.

The squash also removes an artefact of the previous history: the first commit added system/nxpkg/README.txt and a later commit removed it again after review, which made tools/checkpatch.sh fail on the intermediate commit while trying to resolve a path that no longer exists. All checks pass on the squashed commit.

The diff is limited to system/nxpkg/. Keeping this as a draft until I attach the full HTTP lifecycle transcript (sync, install, update, rollback, remove, and checksum rejection) from the ESP32-S3 target.