Apps on the page: list, install and erase overlay apps in the flash image

The Labs edition's apps live in the external flash, in the region its own App/apps/app_overlay.h defines (16 slots of 8 KiB from 0x102000, a 64-byte FAP1 header at the slot base, code one 4 KiB sector later), and upstream installs them from UVStudio over WebSerial. The page owns the image, so this adds GET /api/apps, POST /api/apps/<n> and POST /api/apps/<n>/erase, which put the same bytes at the same offsets with no serial protocol and no browser permission.

Measured on a real image while wiring it up: every one of the 16 slots already held data that is neither empty nor an app -- the localised build's factory resource block overlaps 0x102000 -- so install now refuses to overwrite anything that is not an app unless asked (--force, ?force=1), naming what is there. And _edit_flash edits a copy, which is why the source image shows no changed bytes; the first test read that as 'the install did nothing' and now checks FlashSlot.path. Tests: test_uvk5_apps grew to 20, test_webui.TestAppEndpoints adds 7 over the endpoints.

README.md

@@ -334,6 +334,9 @@ Endpoints, if you want to script it:
 | `GET /api/slots` | the firmware slots in the flash image the emulator uses |
 | `POST /api/slots/<n>` | body is a `.bin`; writes it into slot `n` and restarts |
 | `POST /api/slots/<n>/erase` | erase slot `n` |
+| `GET /api/apps` | the Labs edition's overlay-app slots in the same flash image |
+| `POST /api/apps/<n>` | body is a `.app`; installs it into app slot `n` (add `?force=1` to overwrite data that is not an app) |
+| `POST /api/apps/<n>/erase` | clear app slot `n` |
 | `POST /api/flash` | body is a flash image; use it from now on |
 
 Frames now come from the display controller's own memory: a QMP `qom-get` on the