v0.4.7: download arbitration + resilient session UI

[danielbrownjr]

Summary

Fixes physically reproduced TF-session download starvation in the v0.4.6 web UI.

Root cause

Dense dual-band scans take roughly 11-12 seconds in the validated environment, while the download handler only waited 1 second for the shared radio mutex and also rejected requests whenever a scan was marked pending. In practice, completed-session downloads could repeatedly return 503 before streaming any data.

Changes

• add an explicit download-waiting state
• defer new scans while a download is queued
• allow the current scan to finish naturally
• wait up to 15 seconds for the radio mutex
• keep the radio mutex for the transfer, preserving existing scan/download exclusion
• retain the existing storage reader lease and deferred-unmount behavior
• retain the last good TF session list after transient polling failures
• retry session-list refresh after 1 second instead of replacing good UI state
• label physical-test candidate as v0.4.7 DOWNLOAD RC

Safety / scope

No changes to Wi-Fi scan semantics, TF mount/unmount architecture, OTA, HTTP stack size, or passive/active RF behavior.

Physical validation still required before merge.