Model TIM2, so millis() advances and timeouts can expire

Second finding from the audit. TIM2 was covered by the catch-all stub, which returns
the last value written, so

    uint32_t millis(void) { return LL_TIM_GetCounter(TIM2); }

returned 0 forever. All 17 call sites that measure elapsed milliseconds could never
see time pass -- a silent wrong answer rather than a hang, which is harder to notice
and was not noticed.

The counter is derived on read from QEMU_CLOCK_VIRTUAL rather than stored, with
CR1.CEN starting and freezing it and a CNT write rebasing it. Guest time here is not
proportional to wall time anyway, and code measuring elapsed milliseconds wants
something advancing at roughly the rate a human sees; this is explicitly not for
anything needing cycle accuracy.

Measured: 24358 ms, then 29527 ms five seconds later -- 5169 ms elapsed, so the rate
is right rather than merely non-zero. The test checks the rate for that reason: a
counter ticking at the wrong speed would satisfy "non-zero" and "increasing" and still
break every timeout.

AGENTS.md now carries the audit itself: a table of what the firmware actually drives
against what is modelled versus stubbed, and the point that answering reads is not the
same as being reproduced. The honest summary is that the digital side the firmware
depends on is reproduced, and the analogue side is not and cannot be.

Full run: 15 passed, 0 failed.

README.md

@@ -45,6 +45,7 @@ has no public datasheet, so its driver is the only specification available.
 | S-meter | works via monitor (SIDE1); reads -53 dBm, S9+40 |
 | PTT and transmit | works; TX annunciator, timer, and mic level bar |
 | Speaker / microphone audio | **no samples exist to model**, see [Audio](#audio) |
+| `millis()` / TIM2 | works; advances at roughly wall-clock rate |
 | Timing accuracy | deliberately wrong, see [Timing](#timing) |
 | Analogue RF behaviour | **not modelled and never will be**, see [AGENTS.md](AGENTS.md#the-bk4819-and-where-modelling-it-stops) |
 
@@ -89,6 +90,7 @@ keypresses silently stop working. Run the test after touching that code;
       test_scan.py           a busy band does not stall a scan
       test_audio_path.py     the amplifier turns on when the firmware wants sound
       test_battery.py        battery level and low-battery follow the ADC
+      test_millis.py         millis() advances, so timeouts can expire
       run_tests.sh           runs all of the above, build-checked first
       test_run_tests.sh      that the runner actually notices failures
       lib_kill_emulator.sh   cleanup that only ever kills emulators
@@ -148,6 +150,7 @@ that was never compiled. Individual tests still run standalone:
     python3 tools/test_scan.py
     python3 tools/test_audio_path.py
     python3 tools/test_battery.py
+    python3 tools/test_millis.py
 
 This matters more than it looks. The keypad can break silently under -O2 without
 any compiler warning -- see the `volatile` note in [Status](#status) -- so a clean