feat: Teensy 4.1 M2 persistent identity

[IFindMe]

Summary

• add persistent machine and node X25519 private keys in EEPROM-backed state
• add CRC32 integrity validation and safe regeneration
• add RAM-only tskey-auth- provisioning buffer with explicit wipe
• add M2 serial example and documentation
• add host CI coverage for auth validation and state CRC

Security

• no auth keys or production private keys are committed
• private keys are never printed
• auth keys are never persisted to EEPROM
• temporary/auth buffers are wiped on clear/reset
• corrupt persistent state is rejected before use

Boundary

M2 intentionally stops before the Tailscale /machine/register protocol. M3 will consume the RAM-only auth key and implement the authenticated control-plane transport.