Add authenticated BLE audio streaming, shared link ownership, mic stream API, and config/docs

[MacNite]

Motivation

• Implement authenticated on-request PCM16 audio streaming to satisfy issue Feature request - request audio sample from the hive #71 while keeping RAM usage bounded and privacy controls in firmware.
• Prevent multiple services from racing over a single BLE peripheral connection by centralising connection ownership and arm/disconnect semantics.
• Reuse the PDM configuration path between the periodic read path and continuous streaming to avoid duplicated device setup and drifting parameters.

Description

• Added a shared link manager in src/link.c / src/link.h that centralises BT_CONN_CB_DEFINE behavior, exposes link_conn(), exclusive link_claim() / link_release() ownership for LINK_OWNER_OTA, LINK_OWNER_AUDIO, and LINK_OWNER_THROUGHPUT, and an arm-timeout that disconnects unclaimed connections after HIVE_LINK_ARM_TIMEOUT_MS.
• Implemented the authenticated audio GATT service in src/audio.c / src/audio.h with CTRL/DATA/STATUS characteristics, nonce + truncated HMAC-SHA256 authentication (PSA Crypto), sequenced PCM16 notifications, 30-byte STATUS layout, ring-backed capture, software gain with clipping accounting, CRC-32 over transmitted bytes, notification-credit draining and a 60 s hard cap, and detailed protocol doc docs/audio-over-ble.md.
• Exposed a shared PDM streaming API in src/mic.h / src/mic.c (mic_stream_start(), mic_stream_read(), mic_stream_release(), mic_stream_stop()), increased slab blocks for streaming, reimplemented mic_read() on top of the streaming API, and ensured the sensor loop is gated by link_is_busy() in main.c so the PDM controller is single-ownership.
• Integrated audio into the build and config: bumped firmware version to 0.6.0 in src/hive_config.h, added guarded audio constants (ENABLE_AUDIO, HIVE_AUDIO_MAX_SECONDS, HIVE_AUDIO_RING_BYTES, HIVE_AUDIO_STALL_TIMEOUT_MS, HIVE_AUDIO_CONN_INTERVAL_UNITS, HIVE_LINK_ARM_TIMEOUT_MS) and a BUILD_ASSERT for ring size, updated prj.conf to CONFIG_BT_BUF_ACL_TX_COUNT=6, CONFIG_BT_USER_DATA_LEN_UPDATE=y, CONFIG_BT_USER_PHY_UPDATE=y, and PSA HMAC/SHA-256 symbols, added src/audio_secret.example.h and gitignored src/audio_secret.h, and updated CMakeLists.txt to include link.c and audio.c.
• Adjusted OTA and throughput code to use the shared link ownership API without changing OTA wire protocol or flash streaming semantics, and added README references for the new audio feature.

Testing

• Ran repository sanity checks: git diff --check and source invariant Python assertions for AUDIO_STATUS_LEN, HIVE_AUDIO_MAX_SECONDS, and PSA use, and these checks passed.
• Verified repository symbol and callback placement with rg to confirm BT_CONN_CB_DEFINE is now implemented only in link.c, and pattern checks for the protocol and STATUS layout succeeded.
• Performed local static edits and unit-style assertions, and committed the change to the local tree; no remote operations were performed.
• Attempted the required sysbuild west builds but the west toolchain and NCS environment are not available in this execution environment, so west --sysbuild builds (debug, lowpower, spike) and application size / slot-budget verification could not be executed here and must be run in an NCS v3.3.1 toolchain on a host with west installed.

---

Codex Task