Add Doxygen, clang-format, cppcheck, and Gitea CI

Doxygen:
- Doxyfile: minimal config, HTML output to docs/, no LaTeX
- @file/@brief on all source files, full @param/@return on public API
- docs/ added to .gitignore

clang-format (14, Linux brace style, 4-space, column 100):
- .clang-format added
- Applied to entire codebase; this commit is the canonical baseline
- just format rewrites in-place; just format-check is the CI gate

cppcheck (--enable=warning,style,performance,portability):
- Linker-symbol pointer comparisons in startup.c suppressed with
  inline cppcheck-suppress (false positives, not real bugs)
- just lint runs cppcheck; zero warnings required to pass

Dockerfile gains clang-format, cppcheck, doxygen packages so all
tools run inside the existing container -- host stays clean.

Gitea Actions (.gitea/workflows/ci.yml):
- Four parallel jobs: build, format, lint, docs
- All jobs use the same Dockerfile-based image
- Doxygen job fails on any warning line in output

justfile

@@ -12,6 +12,8 @@ user_ns := `command -v podman >/dev/null 2>&1 \
             && echo "--userns=keep-id" \
             || echo "--user $(id -u):$(id -g)"`
 
+src_files := "find /src/src /src/include -name '*.c' -o -name '*.h'"
+
 # recipes
 # build container image (only rebuilt when Dockerfile changes)
 image-build:
@@ -27,6 +29,44 @@ build: image-build
                      -DCMAKE_BUILD_TYPE=MinSizeRel /src \
                && ninja -C /src/{{build_dir}}"
 
+# reformat all source files in-place with clang-format
+format: image-build
+    {{engine}} run --rm \
+        {{user_ns}} \
+        -v "{{justfile_directory()}}:/src:z" \
+        {{image}} \
+        sh -c "{{src_files}} | xargs clang-format -i --style=file:/src/.clang-format"
+
+# check formatting without modifying files (used in CI)
+format-check: image-build
+    {{engine}} run --rm \
+        {{user_ns}} \
+        -v "{{justfile_directory()}}:/src:z" \
+        {{image}} \
+        sh -c "{{src_files}} | xargs clang-format --dry-run --Werror --style=file:/src/.clang-format"
+
+# static analysis with cppcheck
+lint: image-build
+    {{engine}} run --rm \
+        {{user_ns}} \
+        -v "{{justfile_directory()}}:/src:z" \
+        {{image}} \
+        sh -c "cppcheck --error-exitcode=1 \
+                        --enable=warning,style,performance,portability \
+                        --suppress=missingInclude \
+                        --inline-suppr \
+                        --std=c11 \
+                        -I /src/include \
+                        /src/src/"
+
+# generate HTML documentation with Doxygen
+docs: image-build
+    {{engine}} run --rm \
+        {{user_ns}} \
+        -v "{{justfile_directory()}}:/src:z" \
+        {{image}} \
+        sh -c "cd /src && doxygen Doxyfile"
+
 # flash firmware via pyocd on the host (requires USB / DAPLink)
 flash: build
     pyocd flash --target nrf52840 {{build_dir}}/firmware.hex
@@ -35,10 +75,10 @@ flash: build
 gdbserver:
     pyocd gdbserver --target nrf52840 --port 3333
 
-# remove build artifacts
+# remove build artifacts and generated docs
 clean:
-    rm -rf {{build_dir}}
+    rm -rf {{build_dir}} docs
 
-# remove build artifacts AND the container image
+# remove build artifacts, docs AND the container image
 clean-all: clean
     {{engine}} rmi {{image}} 2>/dev/null || true