firmware: replace flash.sh with a unified node + gateway flasher

[geonnave]

Replaces firmware/flash.sh with a single role-parameterized flasher for both Mari firmware roles over SWD (J-Link), and drops the old script.

Why

The old flash.sh was broken for both roles: it hardcoded app/03app_${APP}/Output/nrf52840dk/.../03app_${APP}-nrf52840dk.bin, so (1) it looked for a .bin SES never emits (linker_output_format="hex"), and (2) the gateway path pointed at a non-existent nrf52840dk directory (the gateway builds under 03app_gateway_app/03app_gateway_net on nrf5340-*). So gateway support was vestigial.

What it does

./flash.sh <node|gateway> --all              # flash every matching connected board
./flash.sh <node|gateway> <snr> [<snr> ...]  # specific J-Link serials
./flash.sh <node|gateway>                    # list connected devices, then exit

• node -> nRF52840, single core, -f NRF52, app 03app_node.
• gateway -> nRF5340, dual core, -f NRF53, app core (03app_gateway_app, CP_APPLICATION) + net core (03app_gateway_net, CP_NETWORK).
• Flash-only by default, no compile. --build to build the role first; --hex (node) or --app-hex/--net-hex (gateway) to supply your own images. Defaults are the role's .emProject outputs.
• Locked boards (factory APPROTECT, read as UNKNOWN) are auto-recovered (full chip erase) with a warning, then flashed.
• Family guard: a node run only touches nRF52840s and a gateway run only touches nRF5340s; a board identified as the wrong family is skipped (use --force). The guard runs before any recover, so flashing nodes can't wipe a gateway and vice versa.
• --dry-run prints every nrfjprog command without running it.

nRF5340 specifics - mirrored from dotbot device, not hardware-verified here

The gateway recover/program sequence (recover both cores via CP_APPLICATION+CP_NETWORK, then chiperase+program app core then net core, in that order) mirrors PyDotBot's tested flash engine exactly. The gateway recovers on every flash by default (as PyDotBot does); --no-recover skips it. I could only dry-run this (no gateway on the bench), so the gateway path wants a real-hardware check before we lean on it.