fix(pin): check final attempt before wiping

[Jdelg718]

Summary

• compare the entered PIN before applying the wipe threshold
• allow a correct PIN on the final configured attempt to unlock and reset the counter
• keep incorrect attempts at the threshold fail-closed
• fail closed when the persisted maximum-attempt value is outside the supported 5–50 range
• add host regression coverage for normal, boundary, and every invalid uint8_t threshold

Closes #148

Security behavior

The failure counter is still pre-incremented and committed before PBKDF2, preserving the existing power-cut-safe accounting. Salt/PBKDF2 and stored-hash failures retain their existing fail-closed threshold behavior.

Test plan

• Regression test demonstrated RED under threshold-first behavior
• Invalid-threshold tests demonstrated RED before remediation
• make -C main/core/test -B test_pin_attempt && ./main/core/test/test_pin_attempt
• ./scripts/test.sh
• ./scripts/format.sh --check
• clean/incremental ESP-IDF v6.0.2 wave_43 firmware build
• git diff --check

Scope

This PR intentionally does not change the pre-existing NVS read/write/commit error policy; it is limited to the final-attempt ordering bug and corrupted threshold handling.