fix(vd960DBN): 消灭 data_json[1024] 中间缓冲, 防 BSS 重叠致 MQTT 上报 _raw 异常

- root cause: data_json[1024] + payload[1400] BSS 合计 2424B,
  叠加 iot_mqtt_srv.c 其他缓冲 (~9KB total), 在 48KB RAM 上
  与 mqttBuf[1024] 重叠, event_report 的 MQTT 二进制
  泄漏到 loop_data payload

- fix: 直接在 payload 构建完整 JSON, 省 1024B BSS
- defense: coil_count > 4 硬限, 防 0xC0 坏帧溢出
- JSON 输出格式不变

- also: set_response_tran_to_notify 加返回值
- also: uart_srv BLE 通知逻辑重构

vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c

@@ -685,20 +685,28 @@ void iot_mqtt_publish_sensor(void) {
         }
     }
 
-    /*--- Step 4: 构建 JSON → 发布 (字段与 V1.02 协议一致) ---*/
-    static char data_json[1024];
+    /*--- Step 4: 构建 JSON → 发布 (字段与 V1.02 协议一致) ---
+       直接构建到 payload, 省掉 data_json[1024] 中间缓冲:
+       - 消除 BSS 压力 (省 1024B), 降低与 mqttBuf 重叠风险
+       - 消除 %s 拷贝尾部二进制残留的路径 (2026-07-23 _raw 事故)
+       - coil_count 边界硬限, 防 0xC0 坏帧致溢出                        */
     static char payload[1400];
-    char *p = data_json;
-    int remaining = sizeof(data_json);
+    char *p = payload;
+    int remaining = sizeof(payload);
     int written;
     const char *freq_level_names[] = {"high", "mid_high", "mid_low", "low"};
     uint8_t i;
+    uint8_t coil_n = _cached_sr.coil_count;
+    if (coil_n > 4) coil_n = 4;  /* 硬限: 防坏帧致 snprintf 循环溢出 */
 
-    written = snprintf(p, remaining, "{\"channels\":[");
+    /* 先写外层包装头 (msg_id/cmd/ts/data) */
+    written = snprintf(p, remaining,
+        "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":{\"channels\":[",
+        ++g_iot_msg_id, dev_time_now());
     if (written < 0 || written >= remaining) return;
     p += written; remaining -= written;
 
-    for (i = 0; i < _cached_sr.coil_count; i++) {
+    for (i = 0; i < coil_n; i++) {
         const LUP_CoilSensor *cs = &_cached_sr.coils[i];
         const char *misc_type_str = "time";
         uint32_t misc_val = 0;
@@ -725,12 +733,7 @@ void iot_mqtt_publish_sensor(void) {
         p += written; remaining -= written;
     }
 
-    snprintf(p, remaining, "]}");
-
-    /* Wrap and publish — V1.01 双主题模型: dld960/{sn}/dev */
-    snprintf(payload, sizeof(payload),
-        "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":%s}",
-        ++g_iot_msg_id, dev_time_now(), data_json);
+    snprintf(p, remaining, "]}}");
 
     {
         char topic[IOT_MQTT_TOPIC_MAX_LEN];