Document the stock firmware dump

Core/SDK version, flash layout, settings files and the hidden /d
hardware page whose Debug mode enables web OTA at /u.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -16,6 +16,21 @@ with ArduinoOTA and Home Assistant (MQTT) support.
 - Stock settings (2026-10-25): time zone +01:00, EU DST on, NTP `time.euro.apple.com`,
   brightness auto, 24 h. Stock DST might not work: check in late March.
 
+## Stock firmware (from the flash dump)
+
+- `firmware/stock/nixie_stock_SV1.3_full_4MB.bin` (gitignored), SHA-256
+  `b069f4eb93cf1e9063a30374db4d70508211f07b0a17049bcf9ebdeda65f2985`, verified against the chip
+  with `verify-flash`. Flash: 4 MB, DIO, 40 MHz.
+- Arduino ESP8266 core 2.x (NONOS SDK 2.2.2-dev), built for board `ESP8266_NODEMCU`. App
+  at 0x1000 (~1 MB slot), SPIFFS at 0x200000. Settings live in SPIFFS as JSON
+  (`/config.json`, `/wifi.json`, `/light.json`, `/leds.json`, `/alerts.json`, `/hardware.json`).
+- **Hidden pages**: `/d` = "Hardware setting" (hidden from the menu by default). It has
+  checkboxes to hide/show menu items and a **Debug mode** (`dev`) checkbox. With Debug
+  mode on, `/u` serves the standard ESP8266HTTPUpdateServer upload form, which is web OTA
+  for `.bin`/`.bin.gz`. `/r` reboots on a plain GET; don't GET unknown paths blindly.
+- No pin numbers are visible as strings; confirming the pinout needs disassembly or the
+  bit-stepping test sketch.
+
 ## Pinout (from the 12 V v2 schematic, `docs/schematic_v2_12V.jpg`)
 
 Not yet verified on this 5 V board. The stock firmware image is the same for both, which