Find the screen buffers in the firmware instead of hardcoding one build's

The page was told --frame-addr 0x200012BE --status-addr 0x2000163E and used them as a fallback. The firmware the user actually flashed keeps its buffers at 0x2000129E/0x2000161E, 32 bytes earlier, so every line landed 32 bytes off: that is the "other firmware looks shifted" report. The images here are minimal ELFs with no symbol table, so there is nothing to read -- but the firmware's own buffers hold the same bytes the controller holds, and tools/uvk5_buffers.py finds them by matching (1024/1024 bytes for that file).

The two address flags are optional now, work/run-webui.ps1 passes no machine-specific values at all, and the page reports what it found in /api/status and /api/panel. tools/uvk5_testenv.qemu() also looks in the sibling qemu-7.2/build the rest of the repo assumes. Fixed /api/panel's emulator-off branch, which called jsonify with both a dict and kwargs and 500'd.

Tests: test_uvk5_buffers (the search must count matches, not pairs -- its first version scored every offset full marks and always answered the first one).

work/run-webui.ps1

@@ -3,6 +3,11 @@
 #   powershell -File work\run-webui.ps1              # the page starts the emulator
 #   powershell -File work\run-webui.ps1 -Attach      # attach to run-emulator.ps1
 #
+# Nothing here is machine-specific. The QEMU binary comes from QEMU or PATH, the
+# interpreter is the one on PATH, the firmware is whatever the checkout has (or one
+# uploaded from the page), the flash image is the last one a session used, and the
+# screen-buffer addresses are read out of the running firmware rather than passed in.
+#
 # Owning the process is what puts the firmware's serial output in the page's log
 # pane: the model prints it to stderr as "SERIAL ..." and the server reads QEMU's
 # stderr. With -Attach the server never sees that stream, so the pane stays empty.
@@ -10,28 +15,52 @@
 param(
     [int]$Port      = 8080,
     [int]$QmpPort   = 4444,
-    [string]$Frame  = '0x200012BE',   # gFrameBuffer, proven against the firmware source
-    [string]$Status = '0x2000163E',   # gStatusLine
-    [string]$Kernel = "$PSScriptRoot\f4hwn\EGZUMER+F4HWN-v5.9.0.CN.elf",
-    [string]$Flash  = [System.IO.Path]::GetFullPath("$PSScriptRoot\..\assets\flash.img"),
-    [string]$Qemu   = 'F:\dsh-build\qemu-7.2.0\build\qemu-system-arm.exe',
+    [string]$Frame  = '',       # only to override the discovered gFrameBuffer
+    [string]$Status = '',       # only to override the discovered gStatusLine
+    [string]$Kernel = '',       # empty: whatever the checkout has, or upload one
+    [string]$Flash  = '',       # empty: the last image a session used
+    [string]$Qemu   = '',       # empty: QEMU or PATH
     [switch]$Attach
 )
 $ErrorActionPreference = 'Stop'
+Set-Location (Join-Path $PSScriptRoot '..')
+
 # The QEMU this server spawns is a native Windows build, so the MSYS2 mingw64 DLLs
 # have to be on the child's PATH -- inherited from here, since the child gets this
 # environment. Without it QEMU dies at load and "power on" reports only that the QMP
 # port never appeared.
-$env:PATH = 'F:\msys64\mingw64\bin;' + $env:PATH
-$py = 'C:\Users\Administrator\.dsh\dsh-runtimes\dsh-primary-runtime\dependencies\python\python.exe'
-Set-Location (Join-Path $PSScriptRoot '..')
+if (Test-Path 'F:\msys64\mingw64\bin') {
+    $env:PATH = 'F:\msys64\mingw64\bin;' + $env:PATH
+}
+
+$py = if ($env:PYTHON) { $env:PYTHON } else {
+    $found = Get-Command python -ErrorAction SilentlyContinue
+    if (-not $found) { $found = Get-Command py -ErrorAction SilentlyContinue }
+    if (-not $found) { throw 'no python on PATH; set PYTHON to one with flask installed' }
+    $found.Source
+}
+
+$common = @('tools\webui.py', '--qmp', "127.0.0.1:$QmpPort", '--port', $Port)
+if ($Frame)  { $common += @('--frame-addr',  $Frame) }
+if ($Status) { $common += @('--status-addr', $Status) }
+
+if (-not $Kernel -and $env:ELF) { $Kernel = $env:ELF }
+if (-not $Flash) {
+    $candidates = @($env:UVK5_FLASH_IMAGE, 'work\user-flash.img', 'assets\flash.img')
+    foreach ($candidate in $candidates) {
+        if ($candidate -and (Test-Path $candidate)) { $Flash = $candidate; break }
+    }
+}
+if (-not $Qemu -and $env:QEMU) { $Qemu = $env:QEMU }
 
-$common = @('tools\webui.py', '--qmp', "127.0.0.1:$QmpPort",
-            '--frame-addr', $Frame, '--status-addr', $Status, '--port', $Port)
 if ($Attach) {
     Write-Host "attaching to an emulator already listening on 127.0.0.1:$QmpPort"
     & $py @common --attach
 } else {
-    Write-Host "the page will start: $Qemu"
-    & $py @common --qemu $Qemu --elf $Kernel --flash $Flash
+    if ($Qemu) { $common += @('--qemu', $Qemu) }
+    if ($Kernel) { $common += @('--elf', $Kernel) }
+    if ($Flash) { $common += @('--flash', $Flash) }
+    Write-Host "the page will start: $(if ($Qemu) { $Qemu } else { 'qemu-system-arm from PATH' })"
+    if ($Flash) { Write-Host "flash image: $Flash" }
+    & $py @common
 }