feat: experimental AP branch/tier selector (0x3FD mux1 UI_apmv3Branch)

[hypery11]

Adds an experimental opt-in AP branch/tier selector (UI_apmv3Branch) on 0x3FD mux 1, bits 40-42 (byte 5 bits 0-2). Values: Off (default) / Live / Stage / Dev / Stage2 / EAP / Demo.

⚠️ Experimental & non-persistent. This injects a UI branch/tier hint only — it reverts the moment injection stops, its real-world effect is unverified, and selecting a non-Live branch (e.g. Dev/EAP) could be a ban signal. Off by default; the dashboard hint says exactly that.

Implemented clean-room from the DBC signal definition (start bit 40, length 3) — no third-party code copied.

Changes

• fsd_state.h: uint8_t apmv3_branch (0xFF sentinel = OFF).
• Flipper + ESP32 0x3FD mux1 handlers: write the 3-bit field when a branch is selected; byte-for-byte unchanged when OFF (only byte5 bits 0-2 touched — no overlap with the bit45/46/47 lane/EAP/summon bits).
• prefs.cpp: NVS apmv3. web_dashboard.cpp: dropdown selector with the experimental hint. test_fsd_core.c: test_apmv3_branch. 500 host tests pass; ESP32 builds clean.
• Not car-validated. Relates to the EAP-tier question in [AntiNag Germany - Juniper new Harness working] <Y Juniper After 04 Berlin> <2026> <HW3> <2026.14.300> — <EU/Germany> #143 — note this is the injection (non-persistent) path, distinct from a persistent config-coding unlock.