fix(L1): gate console enumeration/holder-name prints behind a debug flag

[d33mobile]

Finding (ISSUES.md L1)

main.c prints, per keypad press, whether a key id exists / is corrupt / is disabled, and the holder's NAME on every grant — to the USB console with no admin check and no stdio_usb_connected() gate. That's a live occupancy/attendance log for anyone inside with a cable, plus key-id enumeration before H1/M7. storage.c's [storage] key %u checksum mismatch leaks the same way. (No code/secret is printed — that was removed earlier.)

On current master (8590cdf) these prints are still ungated:

• main.c core0_handle_door_verify() (the keypad-verify path) emits, per press:
  • [door] key %u: not found / : corrupt / : disabled / : invalid code — key-id enumeration oracle
  • [door] key %u (%s): granted — holder name + a live occupancy/attendance log
• storage.c storage_key_get() emits [storage] key %u checksum mismatch — the same per-key enumeration leak, and it fires on the door path too.

Anyone inside with a USB cable can passively read who entered and when, and enumerate valid key ids — with no admin check and no stdio_usb_connected() gate.

Fix

Introduce a compile-time gate HSLOCK_DEBUG (new header shared/debug.h, default 0):

#ifndef HSLOCK_DEBUG
#define HSLOCK_DEBUG 0
#endif
#if HSLOCK_DEBUG
#define DBG(...) printf(__VA_ARGS__)
#else
#define DBG(...) ((void)0)   // arguments not evaluated
#endif

The five leaking [door] prints and the [storage] key %u checksum mismatch print are changed from printf(...) to DBG(...), so they compile to nothing in the shipped build (the default) and can be re-enabled for development with -DHSLOCK_DEBUG=1.

Genuinely-operational output is deliberately kept: the one-time boot/format diagnostics in storage.c (mount FAILED, ensure_dirs failed, init ok, format failed/ok) and main.c's boot/wifi/NTP status lines are not per-key/per-entry and do not leak enumeration, names, or occupancy. Grant/deny signalling to the user is the buzzer (hardware), not a print.

Deferred follow-up

The second bullet of L1 — an in-flash, admin-only audit ring so entries are recorded but only readable after authentication — is a larger feature and is out of scope for this PR; tracked as a follow-up.

Host tests

shared/debug.h is on the host include path; storage.c (harness_storage + coverage) and main.c (coverage) both build with the flag off (default) and on:

• make -C test asan → 0
• make -C test valgrind → 0
• make -C test coverage → 0
• ./ci --action=check → 0

libFuzzer fuzz_*.c harnesses untouched. Firmware (Pico) build not runnable in CI = verify-on-hw.