Add CRC-16/X-25 transport-frame verification to SML decoder

[Copilot]

The SML decoder accepted any structurally plausible telegram without verifying its integrity. This adds CRC-16/X-25 checking at the transport layer, matching the algorithm used by sml2mqtt/smllib.

Changes

• SML_CRC16_TABLE[256] — 256-entry lookup table (reflected poly 0x8408), identical to smllib/crc/x25.py
• smlCrc16(buf, len) — CRC-16/X-25 (init=0xFFFF, xorout=0xFFFF) over an arbitrary byte range
• decodeSml() updated:
  • Records startPos at the start of the 1B1B1B1B 01010101 header
  • After the message loop, fully validates the end escape (1B1B1B1B 1A PP CRC_LO CRC_HI)
  • Computes CRC over buf[startPos .. endEscape+5] (through the padding byte) and returns false on mismatch

The CRC is stored little-endian in the end escape:

1B 1B 1B 1B  1A  PP  CRC_LO  CRC_HI
                      ^^^^^^  ^^^^^^
                      crc & 0xFF  crc >> 8