Add thermostat control for heat and fan with cycle protection

Turns the weather dashboard into an actual thermostat. Relays are not
fitted yet -- the GPIOs are driven and can be metered at the UART1-OUT
plug (idle 3.3V, energized 0V, active-low module assumed).

Control loop (main/control/thermostat.c) is pure logic: no ESP-IDF, no
network, no clock of its own. The caller passes a temperature and a
millisecond timestamp, which is what lets the simulator and the test
harness run the identical decision code.

Equipment protections, all verified by tools/thermostat_test.c:

  deadband      1.0F    stops the burner chattering at the setpoint
  minimum on    3 min   a shorter call is all ignition wear, no heat
  minimum off   5 min   back-to-back ignitions are what kill igniters
  cycles/hour   5       standard gas default; catches a flapping sensor
  boot lockout  60 s    a boot loop must not machine-gun the gas valve

That test drives the state machine with synthetic time, so two hours of
furnace behaviour runs in milliseconds. It exits non-zero on failure and
is worth re-running after any edit to thermostat.c -- this switches a gas
valve.

Two deliberate decisions:

  - G is never energized during a heat call. The furnace runs its own
    blower with a fan-on delay that waits for the heat exchanger and a
    fan-off delay that scavenges residual heat; driving G ourselves would
    blow cold air at people and throw that heat away. G is manual
    circulation only.
  - The control loop starts before every early return in app_main. Those
    returns are all "no WiFi" or "no HA token", and none of them is a
    reason to leave a house unheated.

Relay pins are IO20 heat / IO19 fan on the UART1-OUT plug, measured on
this board since Elecrow documents the GPIO numbers but not the connector
pin order. Heat is on IO20 because it is USB D+, the line carrying the
hardware pull-up -- with an active-low module it fails toward "no heat"
rather than "heat stuck on" if the USB PHY is ever re-enabled. Both pins
were confirmed free of the onboard mic before use.
CONFIG_USJ_ENABLE_USB_SERIAL_JTAG and CONFIG_ESP_PHY_ENABLE_USB are now
off to release them; the console is on UART0 via the CH340 regardless.

UI: the indoor card gains a status dot, mode and fan buttons, and a
setpoint column with finger-sized up/down targets. The reading grid drops
from six cells to four to make room -- wind was the one to cut, since the
station anemometer has been dead since 2026-07-27 and that cell has never
shown a number. Wind now rides on the outdoor cell's sub-line and will
reappear on its own if the sensor is fixed. Sunrise and sunset share a
cell, showing whichever comes next.

Known weakness, documented in README and top of TODO: indoor temperature
comes from Home Assistant over the network, so an HA outage ages the
reading until the 15-minute failsafe forces heat off. A local I2C sensor
removes the failure mode entirely and is the next thing to add. The
setpoint also resets to 68F on reboot, because persisting it means an NVS
write and a flash write while the panel scans faults the bounce-buffer
ISR.

Co-Authored-By: Claude <noreply@anthropic.com>

main/main.c

@@ -5,6 +5,7 @@
 #include "esp_log.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/queue.h"
+#include "freertos/semphr.h"
 #include "freertos/task.h"
 
 #include "ambient_weather.h"
@@ -15,6 +16,8 @@
 #include "ha_data.h"
 #include "i2c_bus.h"
 #include "lvgl_port.h"
+#include "relay.h"
+#include "thermostat.h"
 #include "touch_gt911.h"
 #include "ui_manager.h"
 #include "wifi_manager.h"
@@ -50,6 +53,12 @@ static const char *TAG = "main";
  * be dropped, but a user cannot meaningfully get more than a few ahead. */
 #define CMD_QUEUE_DEPTH 8
 
+/* The control loop runs at 1Hz -- fast enough for a live lockout countdown,
+ * and far faster than a house changes temperature. */
+#define THERM_TASK_STACK 4096
+#define THERM_TASK_PRIO  4
+#define THERM_TICK_MS    1000
+
 typedef struct {
     int     index;
     bool    on;
@@ -61,6 +70,110 @@ static QueueHandle_t cmd_queue;
 /* The single copy of what is on screen. Only the HA task touches it. */
 static ha_data_t ha_data;
 
+/*
+ * Indoor temperature handed from the HA task to the control task.
+ *
+ * Guarded rather than assumed-atomic: a float store is a single word on this
+ * core, but the value and its timestamp must agree with each other, and the
+ * staleness failsafe depends on that pairing being consistent.
+ */
+static SemaphoreHandle_t temp_mutex;
+static float    indoor_temp_f;
+static bool     indoor_temp_valid;
+static uint32_t indoor_temp_ms;
+
+static uint32_t uptime_ms(void)
+{
+    return (uint32_t)(xTaskGetTickCount() * portTICK_PERIOD_MS);
+}
+
+static void publish_indoor_temp(const ha_value_t *v)
+{
+    if (temp_mutex == NULL || xSemaphoreTake(temp_mutex, pdMS_TO_TICKS(100)) != pdTRUE) {
+        return;
+    }
+    if (v->valid) {
+        indoor_temp_f = v->value;
+        indoor_temp_valid = true;
+        indoor_temp_ms = uptime_ms();
+    }
+    xSemaphoreGive(temp_mutex);
+}
+
+static bool take_indoor_temp(float *out_f)
+{
+    if (temp_mutex == NULL || xSemaphoreTake(temp_mutex, pdMS_TO_TICKS(100)) != pdTRUE) {
+        return false;
+    }
+    const bool valid = indoor_temp_valid;
+    *out_f = indoor_temp_f;
+    xSemaphoreGive(temp_mutex);
+    return valid;
+}
+
+/*
+ * The control loop. Deliberately independent of Home Assistant: it needs only
+ * a temperature and a clock, so an HA outage cannot stop the house being
+ * heated -- the reading simply ages, and thermostat_tick() applies its own
+ * staleness failsafe once it is too old to trust.
+ */
+static void thermostat_task(void *arg)
+{
+    therm_status_t status;
+
+    while (1) {
+        float temp = 0.0f;
+        const bool valid = take_indoor_temp(&temp);
+
+        thermostat_tick(temp, valid, uptime_ms());
+        thermostat_get_status(&status);
+
+        relay_set(RELAY_HEAT, status.heat_relay);
+        relay_set(RELAY_FAN, status.fan_relay);
+
+        ui_update_thermostat(&status);
+
+        vTaskDelay(pdMS_TO_TICKS(THERM_TICK_MS));
+    }
+}
+
+/*
+ * Runs on the LVGL task with the lock held. No network here, so the change
+ * applies immediately and the display is refreshed straight back -- the
+ * button feels instant because it is.
+ */
+static void therm_cmd_from_ui(ui_therm_cmd_t cmd)
+{
+    switch (cmd) {
+    case UI_THERM_SETPOINT_UP:
+        thermostat_adjust_setpoint(1.0f);
+        break;
+    case UI_THERM_SETPOINT_DOWN:
+        thermostat_adjust_setpoint(-1.0f);
+        break;
+    case UI_THERM_MODE_TOGGLE:
+        thermostat_set_mode(thermostat_get_mode() == THERM_MODE_HEAT
+                                ? THERM_MODE_OFF : THERM_MODE_HEAT);
+        break;
+    case UI_THERM_FAN_TOGGLE:
+        thermostat_set_fan(thermostat_get_fan() == THERM_FAN_ON
+                               ? THERM_FAN_AUTO : THERM_FAN_ON);
+        break;
+    }
+
+    /*
+     * Apply the fan immediately rather than waiting up to a second for the
+     * control task -- a button that lags its own relay feels broken. Heat is
+     * left to the control task, which is where the protection timers live;
+     * nothing here may light a burner.
+     */
+    therm_status_t status;
+    thermostat_get_status(&status);
+    relay_set(RELAY_FAN, status.fan_relay);
+
+    ui_update_thermostat(&status);
+}
+
 /*
  * Runs on the LVGL task with the LVGL lock held, so it must not block.
  * Queueing hands the HTTP request to the HA task; a request from here would
@@ -221,6 +334,10 @@ static void ha_task(void *arg)
             ha_data.trend_pressure =
                 ha_trend_compute(HA_TREND_CH_PRESSURE, TREND_PRESS_PER_HOUR_INHG, now_ms);
 
+            /* Hand the reading to the control loop, which runs on its own
+             * task and does not care where it came from. */
+            publish_indoor_temp(&ha_data.indoor_temp_f);
+
             ui_update(&ha_data);
             ui_set_stale(false);
 
@@ -253,6 +370,35 @@ static void ha_task(void *arg)
     }
 }
 
+/*
+ * The furnace must run whether or not anything else does.
+ *
+ * Every early return further down app_main() is about WiFi or Home Assistant
+ * being unusable -- no SSID, no token, no cloud fallback. None of those are
+ * reasons to leave a house unheated, so the control loop starts before any of
+ * them can bail out. It needs only a temperature and a clock; where the
+ * temperature comes from is somebody else's problem.
+ */
+static void start_thermostat(void)
+{
+    temp_mutex = xSemaphoreCreateMutex();
+    if (temp_mutex == NULL) {
+        ESP_LOGE(TAG, "Could not create the temperature mutex");
+        return;
+    }
+
+    ui_set_therm_cb(therm_cmd_from_ui);
+
+    xTaskCreate(thermostat_task, "therm", THERM_TASK_STACK, NULL,
+                THERM_TASK_PRIO, NULL);
+
+    ESP_LOGI(TAG, "Thermostat running: setpoint %.0f F, %d min on / %d min off, "
+                  "max %d cycles/hr",
+             thermostat_get_setpoint(),
+             (int)(THERM_MIN_ON_MS / 60000), (int)(THERM_MIN_OFF_MS / 60000),
+             THERM_MAX_CYCLES_PER_HOUR);
+}
+
 void app_main(void)
 {
     ESP_LOGI(TAG, "Thermostat HMI -- CrowPanel 7.0\" ESP32-S3 (800x480)");
@@ -275,6 +421,15 @@ void app_main(void)
      */
     ESP_ERROR_CHECK(display_alloc());
 
+    /*
+     * Relays before anything that can fail or take time. relay_init() only
+     * touches two GPIOs, and until it runs those pads are whatever reset left
+     * them -- so the sooner they are pinned to the de-energized level, the
+     * shorter the window in which a relay board could see an undefined input.
+     */
+    ESP_ERROR_CHECK(relay_init());
+    thermostat_init(uptime_ms());
+
     const esp_err_t wifi_err = wifi_init_sta();
     if (wifi_err != ESP_OK) {
         ESP_LOGE(TAG, "WiFi not up yet -- polling starts when it connects");
@@ -310,6 +465,9 @@ void app_main(void)
     vTaskDelay(pdMS_TO_TICKS(100));
     ESP_ERROR_CHECK(backlight_set(255));
 
+    /* Before the WiFi/HA branches below, any of which may return. */
+    start_thermostat();
+
     if (wifi_err == ESP_OK) {
         char status[96];
         wifi_get_status(status, sizeof(status));