Step 6.2: role hand-over, session_ver bump on GM change

- aes67_cfg: cfg_set_number(group, key, value, apply) for firmware-side
  changes, stored in NVS like a POST; apply can be skipped.
- aes67_sdp_sap: once a second, a change of the PTP GM (ts-refclk) bumps
  aes67.session_ver without re-applying the aes67 group (no stream
  restart); SAP then re-announces. Runs whether or not SAP is on.
- Verified with ptp4l as a normal clock (p1 128): board auto (p1 250)
  steps down to SLAVE (session_ver 1->2); role master p1 100 via API ->
  board MASTER at once (->3); back to auto p1 250 -> ptp4l takes over
  within ~1 s, board SLAVE again (->4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

components/aes67_web/cfg.c

@@ -232,6 +232,37 @@ cJSON *cfg_get(const char *group)
     return copy;
 }
 
+esp_err_t cfg_set_number(const char *group, const char *key, double value, bool apply)
+{
+    if (!s_lock) {
+        return ESP_ERR_INVALID_STATE;
+    }
+    xSemaphoreTake(s_lock, portMAX_DELAY);
+    cfg_group_t *g = find(group);
+    cJSON *cur = g ? cJSON_GetObjectItemCaseSensitive(g->values, key) : NULL;
+    esp_err_t err = ESP_OK;
+    if (!cur || !cJSON_IsNumber(cur)) {
+        err = ESP_ERR_NOT_FOUND;
+    } else {
+        cJSON_SetNumberValue(cur, value);
+        nvs_handle_t h;
+        if (s_nvs_ok && (err = nvs_open(NVS_NAMESPACE, NVS_READWRITE, &h)) == ESP_OK) {
+            err = store(h, g);
+            if (err == ESP_OK) {
+                err = nvs_commit(h);
+            }
+            nvs_close(h);
+        }
+    }
+    cJSON *copy = err == ESP_OK && apply && g->apply ? cJSON_Duplicate(g->values, true) : NULL;
+    xSemaphoreGive(s_lock);
+    if (copy) {
+        g->apply(copy);
+        cJSON_Delete(copy);
+    }
+    return err;
+}
+
 /* ----- HTTP ----- */
 
 static esp_err_t config_get(httpd_req_t *req)