v0.10.9

Drive health, and the fixes from the review of 31 Oct (#135–#143).

• Health tab: the logger page's new Health tab scores each warm drive's channels (fueling, ignition and knock, temperatures and oil, boost, misfires, electrical) against the channel's own last ten healthy drives, cell by RPM and load, as a heatmap with a drill-down to the trend, the cells and the raw log. The trend shows the channel's own units, a tick per drive and a line per day. drive_health in MCP lists the newest drives first and never more than a reply holds.
• App, batching and sync: one unanswered batch no longer turns a DME's batched reads off for the session; a timeout rests them 30 s. A cloud secret saved on another PC reads as empty and asks to be entered again, rather than stopping Settings and sync. Unexpected sync errors are shown and the sync carries on; History's scan shows its errors instead of hanging.
• App, gateway refusals: a module the gateway turns away (0x0045 just after ignition-on) rests like a silent one instead of ending a watch or forcing a reconnect. While logging, only a connection error reconnects.
• App, saves: every save writes its own temporary file, so two History scans at once can't collide, and a failed write leaves nothing behind.
• Worker: the board's token is pinned and limited to what the board needs; firmware is published only by a person's login or a listed token. Uploads and the logger page read much less (series pieces keep their first and last values; Health rescoring runs from the changed drive on). The "Never changed" and "Only goes up" filters leave out what the board, tanks, fault dates and Health read.
• Firmware: an update is kept only once it checks in; a power cut can no longer leave an upload, a .done or channels.csv stuck for good; a check-in reply can't change the Worker host; held check-ins live in PSRAM, away from the memory TLS needs.