Step 6.2: role hand-over, session_ver bump on GM change

- aes67_cfg: cfg_set_number(group, key, value, apply) for firmware-side
  changes, stored in NVS like a POST; apply can be skipped.
- aes67_sdp_sap: once a second, a change of the PTP GM (ts-refclk) bumps
  aes67.session_ver without re-applying the aes67 group (no stream
  restart); SAP then re-announces. Runs whether or not SAP is on.
- Verified with ptp4l as a normal clock (p1 128): board auto (p1 250)
  steps down to SLAVE (session_ver 1->2); role master p1 100 via API ->
  board MASTER at once (->3); back to auto p1 250 -> ptp4l takes over
  within ~1 s, board SLAVE again (->4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

components/aes67_web/include/aes67_cfg.h

@@ -20,6 +20,9 @@ esp_err_t cfg_register(const char *group, const char *defaults_json,
                        cfg_validate_cb_t validate, cfg_apply_cb_t apply);
 // Copy of a group's current values; caller frees with cJSON_Delete. NULL if not registered.
 cJSON *cfg_get(const char *group);
+// Firmware-side change of one number (e.g. aes67.session_ver): stored like a POST, no validation.
+// apply = false skips the group's apply callback (e.g. to avoid restarting the stream).
+esp_err_t cfg_set_number(const char *group, const char *key, double value, bool apply);
 
 // Validation helpers for validate callbacks. Each returns false and fills err on failure.
 bool cfg_check_num(const cJSON *g, const char *key, double min, double max, char *err, size_t n);