Add centrally arbitrated DMA leases to dmdma

[JaxCalder]

Closes choco-technologies/dmod-ecosystem#10.

Summary

• New dmdma_lease.h: dmdma_lease_acquire/_release/_start/_abort/_is_busy/_get_remaining/_set_callback, exposed as a plain Module API (dmod's README, "Module API" section) - dmdma is the one and only implementation of it, so consumers just call these functions directly (e.g. dmdma_lease_acquire(controller, stream)), patched by the loader against dmdma's own registration exactly the way dmdma_port_stream_start() already works. No runtime lookup ceremony, no Dmod_GetModuleContext()/Dmod_GetDifFunction() - that's DIF, which is for a 1:N "multiple modules implement the same interface, discovered at runtime" relationship (e.g. dmramfs/dmffs both implementing dmfsi), which doesn't apply here. (An earlier version of this branch used DIF for this and needed a hand-written registration workaround to make it work at all - that was the wrong tool for a 1:1 relationship; it's been replaced with the plain Module API pattern, which needs no such workaround.)
• Lease reservations and /dev/dmdmaN/M device-node opens share the exact same stream-slot bookkeeping (dmdma_slot_owner_t tag) - the same stream can never be acquired twice through any API combination, and a slot opened one way can't be driven through the other API.
• New dmdma_transfer_config_t.timeout_ms: arms a real dmosi_timer watchdog that auto-aborts the stream and fires a new dmdma_event_timeout if the transfer doesn't finish in time - shared by both the lease and the existing device-node ioctl path.
• New dmdma_event_aborted: fires (synchronously, only if a transfer was genuinely in flight) when a caller explicitly aborts, on both paths.
• Transfer validation (direction/request-line consistency, address alignment, non-zero length) is now centralized in validate_transfer_config() and shared by both start paths, instead of only partially checked in the ioctl path.

Real-hardware verification (STM32F746G-DISCO, DMA2 stream 0)

Built a full dmod-boot firmware image against this branch and ran a new on-target smoke test (tests/dmdma_test_lease.c) through the actual shell console - not just host-side unit tests. All of the following passed on real silicon:

• Acquire, and double-acquire on the same stream correctly rejected
• Aborting an idle stream fires no callback
• A real 16 KiB memory-to-memory transfer completes, data verifies byte-for-byte, and the callback fires with the correct event and user_ptr
• Malformed configs (zero length, request line on a mem-to-mem transfer) rejected before touching hardware
• Abort while a transfer is genuinely in flight stops it and notifies the owner
• The dmosi_timer watchdog fires dmdma_event_timeout and auto-stops the stream
• Release returns the stream to the free pool cleanly (re-acquire succeeds)

One real bug only surfaced through this hardware run (fixed in this branch, not visible from compilation alone): the watchdog was being disarmed on every dmdma_event_complete, but that flag fires at every wrap of a circular transfer, not just a true final completion - so a circular transfer's own watchdog was being cancelled after its first lap. Fixed by tracking whether the active transfer is circular and only treating complete as terminal when it isn't.

Test plan

• Host cross-compile clean for both stm32f4 and stm32f7 CPU families (arm-none-eabi-gcc)
• Existing dmdma_test_dev/dmdma_test_port on-target smoke tests still compile against the updated dmdma_transfer_config_t (added explicit timeout_ms = 0)
• New dmdma_test_lease on-target smoke test passes end-to-end on real STM32F746G-DISCO hardware (see above), re-verified after switching from DIF to the plain Module API pattern