v1.3.0: Add 14 keyfob protocols (8 ProtoPirate + 6 Flipper-ARF), fix KeeLoq overflow

Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the
D4C1-Labs/Flipper-ARF firmware:

  ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static,
  Honda V1, Land Rover V0.
  Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4,
  Porsche Cayenne, PSA2.

Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it
cannot false-match existing protocols; every previously-decoding IMPORTS capture
decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static
(Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the
rest are validated by encode/decode round-trip and synthetic-frame tests.

Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt
(15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap;
release behavior unchanged).

Adds per-protocol docs, updates the README protocol table, capture metadata
(encoding / RF / encryption), make-suggestion mapping, and CHANGELOG.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73

docs/bmw_cas4.md

@@ -0,0 +1,64 @@
+---
+layout: default
+---
+
+# BMW CAS4 Protocol
+
+**Rust module:** `src/protocols/bmw_cas4.rs`
+**Reference:** `Flipper-ARF lib/subghz/protocols/bmw_cas4.c`
+
+## Overview
+
+BMW CAS4 uses Manchester encoding at 500/1000 µs. 64 bits (8 bytes), AM/OOK. The CAS4 rolling cipher's
+manufacturer key is not available, so the encrypted portion is left as-is — the frame is only framed and
+validated, not decrypted. Emission is gated on two fixed marker bytes (`byte[0] == 0x30` and
+`byte[6] == 0xC5`), which makes the protocol specific and prevents false matches.
+
+The Manchester decoder uses Flipper's `manchester_decoder.h` transition table, with polarity
+`level ? Low : High` (the same mapping as Ford V0 / common).
+
+## Timing
+
+| Parameter      | Value   | Notes                       |
+|----------------|---------|-----------------------------|
+| Short          | 500 µs  | ±150 µs (te_delta)          |
+| Long           | 1000 µs | ±150 µs                     |
+| Preamble pulse | 300–700 µs |                          |
+| Gap            | ≥1800 µs | separates preamble from data |
+| Min bits       | 64      | 8 bytes                     |
+| Preamble       | ≥10 pulses |                          |
+
+## Frame Layout (64 bits / 8 bytes)
+
+- **byte 0:** fixed marker `0x30`
+- **bytes 1–3:** serial (24-bit)
+- **byte 5:** counter
+- **byte 6:** fixed marker `0xC5`
+- **byte 7:** button
+
+The CAS4 rolling cipher is left undecrypted; the two markers serve as the integrity gate.
+
+## RF
+
+- **Encoding:** Manchester (Flipper table, polarity `level ? Low : High`)
+- **RF modulation:** AM/OOK
+- **Encryption:** CAS4 rolling cipher left undecrypted (no manufacturer key); gated on fixed markers `0x30`/`0xC5`
+- **Frequencies:** 433.92 MHz only
+
+## Decoder Steps
+
+1. **Reset** — begin on a HIGH preamble pulse within the 300–700 µs window.
+2. **Preamble** — count preamble pulses; a long LOW gap (≥1800 µs) with ≥10 pulses enters Data.
+3. **Data** — Manchester-decode 64 bits MSB-first; at the 64th bit, require `byte[0]==0x30 && byte[6]==0xC5`, build the signal on success, and reset. An out-of-range pulse aborts.
+
+## Encoder
+
+Not supported (the reference encoder is a non-functional stub: `yield` returns reset, `deserialize`
+returns error). Decode-only.
+
+## Validation
+
+Verified by a synthetic-frame check (no local capture available): a unit test Manchester-encodes a frame
+by driving the decoder's own transition table (the Flipper table is differential, so there is no
+fixed per-bit pattern), confirms it decodes with the right serial/counter/button, and confirms a frame
+with wrong marker bytes is rejected.