Feat/two way radio communication

[ivan-lyf]

Implements the rocket side of two-way radio communication: FALCON now receives GroundCommand protobufs uplinked through the RFD900x/GNSS board, acts on camera-control commands (VTX/RunCam power), reports camera status in telemetry, shuts the cameras down on landing by cutting the camera power rail, and reconfigures the rocket-side RFD900x modem from an uplinked RfdConfig through a fail-safe AT command session.

Downlink

• Added GroundCommand.proto to the nanopb generation list and removed the deleted HelloWorldPacket (its removal upstream had broken all builds).
• New shared struct camera_data in data.c/h (same mutex pattern as the other snapshots); every telemetry packet now populates runcam_power (field 21) and runcam_recording (field 34).

Uplink receive path

• radio/gnss_spi.c — single mutex-guarded access point for the GNSS/radio board on SPI1, which now has three consumers: telemetry TX, GPS RX, and command RX.
• radio/command_thread.c — polls for uplinked frames every 200 ms, decodes COBS → CRC16 → protobuf, dedups on command_id, and dispatches through a k_msgq to an executor thread so slow command handling never stalls RX polling. Command effects are acked implicitly via the telemetry status fields.

Camera control

• camera/vtx_power.c — drives the VTX/RunCam power switch GPIO (PD6, confirmed by hardware). Defaults on at boot so a mid-flight reboot can't leave the cameras dark; powering off also clears the recording flag.
• camera/runcam.c — RunCam Device Protocol frames (0xCC header, CRC8-0xD5) over UART4. Dormant for now: the RunCam has auto-recording enabled, so recording follows the power rail and nothing sends these frames. The executor acts only on vtx_runcam_power; camera_recording commands are logged and ignored until the protobufs are reworked to carry RunCam commands. runcam_init() still runs at boot to validate the UART wiring.
• Both fall back to simulated implementations when the devicetree alias is absent (native_sim).

Landed shutdown

• state_action_landed() (previously a TODO stub) cuts VTX/RunCam power; since the camera auto-records while powered, that also ends the recording. No UART stop frame is sent. Final telemetry packets report both camera fields false. Covered by a state-machine test (no RunCam command sent, power cut exactly once).

RFD900x remote reconfiguration

Resolved: FALCON applies rfd_config to the rocket-side modem (the "ground-local" comment in GroundCommand.proto is stale). A half-applied config would kill the link permanently, so the session is built so it can never commit a partial config:

• radio/rfd900x_at.c — transport-agnostic AT session engine: guard-time silence → +++ → OK, then per populated field ATSn=v (S2 air speed, S3 net id, S4 power, S8/S9 min/max freq, S10 channels), each requiring OK and a matching ATSn? readback, then AT&W → OK, then ATZ.
• The config is validated before the modem is touched (per-register ranges plus min_freq ≤ max_freq); an empty or invalid RfdConfig sends zero bytes. AT&W is only sent after every write is verified; ATZ only after AT&W is acknowledged. Any earlier failure (timeout, ERROR, readback mismatch) aborts with ATO, so EEPROM keeps the config the link was established with.
• radio/rfd900x.c — UART transport behind the new rfd-uart devicetree alias; suspends telemetry TX for the session (radio_tx_suspend()) so the +++ guard time sees a silent serial line. Simulated when the alias is absent (native_sim).
• Response parsing tolerates command echo, blank lines, and RSSI noise; only a bare OK / all-digit value line counts.
• New test suite firmware/tests/rfd900x runs the engine against a scripted mock modem — 12/12 passing on native_sim: happy path (all six registers), partial config, zero-value field (NETID 0), echo/noise tolerance, empty config, min>max, out-of-range values, no OK after +++, ERROR reply, mid-sequence silence, readback mismatch, and unacknowledged AT&W (asserts ATZ is never sent).

---

Assumed — still needs an answer

Everything unconfirmed is centralized in firmware/src/uplink_config.h (constants) and boards/ubcrocket/polarity/ubcrocket_polarity.dts (pins), so each answer is a one-line change.

#	Assumption
1	UART4 pin pair: PA0/PA1 assumed. Package also offers PA12/PA11, PB9/PB8, PD1/PD0, PD12/PD11 (PC10/PC11 are taken by SDMMC). UART4 as the RunCam port and USART2-disabled are confirmed.
2	PD6 active level: active-high assumed for the VTX/RunCam power switch.
3	Radio-RX SPI opcode 0x06 and its framing (assumed to mirror the GPS read 0x05: [CMD:1][DUMMY:4][PAYLOAD:256], COBS frame zero-filled when nothing is pending).
4	RunCam UART command set (public RunCam Device Protocol assumed: 0xCC header, CRC8 poly 0xD5, 115200 baud). Dormant until the protobuf rework, but needed before reactivation.
5	Modem serial path: a direct FALCON → modem line on USART2 PA2/PA3 @ 57600 is assumed (rfd-uart alias). If the real path is AT-passthrough via the GNSS board, only the transport in rfd900x.c changes — the AT session engine is transport-agnostic.
6	RfdConfig validation bounds in uplink_config.h (902–928 MHz, NETID ≤ 499, power ≤ 30 dBm, air speed 4–750, 1–50 channels) follow the RFD900x/SiK S-register docs — confirm against the actual modem firmware limits and the finalized command list.

Known limitations

• Telemetry runcam_recording currently always reads false — recording is inferred from the power rail and nothing sets the flag. Revisit with the protobuf rework (or set it optimistically on power-on if the ground station needs it sooner).
• The native_sim radio emulator (sim_radio) accepts telemetry TX and returns all-zero reads, so uplink commands cannot be injected in sim yet — the decode path (COBS/CRC/protobuf/dedup) runs only on real hardware. An injection hook is future work.
• The AT session engine is unit-tested against a mocked modem only; the full flow still needs bench-testing with two real RFD900x modems, and the reconfiguration sequencing with the ground station (rocket-side modem first, ground follows; recovery window if the link doesn't come back) is a ground-side procedure that still needs to be defined.

[jasonkwok475]

Untested, do tests on native sim with this in the future if needed