v1.3.0: Add 14 keyfob protocols (8 ProtoPirate + 6 Flipper-ARF), fix KeeLoq overflow

Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the
D4C1-Labs/Flipper-ARF firmware:

  ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static,
  Honda V1, Land Rover V0.
  Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4,
  Porsche Cayenne, PSA2.

Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it
cannot false-match existing protocols; every previously-decoding IMPORTS capture
decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static
(Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the
rest are validated by encode/decode round-trip and synthetic-frame tests.

Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt
(15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap;
release behavior unchanged).

Adds per-protocol docs, updates the README protocol table, capture metadata
(encoding / RF / encryption), make-suggestion mapping, and CHANGELOG.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73

docs/ford_v3.md

@@ -0,0 +1,55 @@
+---
+layout: default
+---
+
+# Ford V3 Protocol
+
+**Rust module:** `src/protocols/ford_v3.rs`
+**Reference:** `REFERENCES/ProtoPirate/protocols/ford_v3.c`
+
+## Overview
+
+Ford V3 uses Manchester encoding at 240/480 µs. 104 bits total (13 bytes), transmitted as plaintext —
+there is no CRC or encryption. Decode-only: the ProtoPirate reference ships a NULL encoder, so KAT
+does not transmit Ford V3 (Replay still works on the raw capture).
+
+The Manchester decoder uses Flipper's `manchester_decoder.h` transition table (same table as Ford V0),
+but Ford V3 maps the level the opposite way from Ford V0: `level ? High : Low`.
+
+## Timing
+
+| Parameter | Value  | Notes              |
+|-----------|--------|--------------------|
+| Short     | 240 µs | ±60 µs (te_delta)  |
+| Long      | 480 µs | ±60 µs             |
+| Min bits  | 104    | 13 bytes           |
+| Preamble  | ≥30 short pulses | before first long |
+
+## Frame Layout (104 bits / 13 bytes)
+
+- **byte 0:** header
+- **bytes 1–4:** serial (32-bit, big-endian)
+- **byte 5:** hop/reserved
+- **byte 6:** button — bit 0 set → Unlock, else Lock
+- **bytes 7–8:** counter, stored bitwise-inverted (`~b[7]`, `~b[8]`)
+- **bytes 9–12:** rolling/hop tail (not parsed)
+
+## Decoder Steps
+
+1. **Reset** — a short pulse (~240 µs) starts the preamble (count = 1).
+2. **Preamble** — count short pulses; once ≥30 shorts are seen, a long pulse begins the data
+   (Manchester state seeded to Mid1, first bit decoded from the long pulse).
+3. **Data** — Manchester events (short/long × level) feed the state machine; bits pack MSB-first into
+   13 bytes. At 104 bits the fields are parsed and the signal is emitted. A non-short/non-long pulse
+   (gap) ends the frame.
+
+## RF
+
+- **Encoding:** Manchester
+- **RF modulation:** FM (per ProtoPirate `SubGhzProtocolFlag_FM`)
+- **Encryption:** none (plaintext)
+- **Frequencies:** 315 MHz, 433.92 MHz
+
+## Encoder
+
+Not supported (reference encoder is NULL). Decode-only.