Firmware: verify config MAC matches device before applying

[TalkingJupiter]

Context

docs/mqtt-contract.md §4 specifies that a config is rejected if its mac field is not this device's own MAC ("config wasn't meant for us"). The firmware does not do this yet — onMqttMessage only checks that the message arrived on gConfigTopic, and parseRuntimeConfigJson parses cfg.mac but never compares it to the device's own gMacSafe.

This matters as defense-in-depth: a wrong/stale retained message, a broker misroute, or a hand-typed mosquitto_pub to the wrong topic could otherwise apply a config meant for another device.

Scope

Reject a config whose mac does not equal the device's own compact MAC.

Implementation notes

• Compare against gMacSafe (uppercase, no separators, 12 chars — the §4 MAC format).
• Cleanest spot is onMqttMessage after parsing, or inside parseRuntimeConfigJson if the device MAC is passed in.
• Log the rejection with both MACs so a mismatch is obvious on serial.

Acceptance criteria

• Config with a non-matching mac is rejected and not applied, with a clear log.
• Config with the correct mac still applies.
• Matches docs/mqtt-contract.md §4.

Relates to #11.