feat(lib,gui): the browser shows images -- a PNG/BMP decoder, DEFLATE and all

The Web app could only render text. Now it decodes and displays images, so a
picture on the web actually shows up.

  - lib/inflate.c   DEFLATE / zlib decompressor (RFC 1950/1951): the algorithm
                    every PNG needs. Canonical Huffman, all three block types,
                    decodes into a caller buffer -- no allocation, integer only.
  - lib/image.c     PNG decoder (8-bit RGB/RGBA/grayscale/gray+alpha, and
                    1/2/4/8-bit grayscale & palette, non-interlaced; tRNS
                    transparency) plus BMP (24/32-bit). Parses chunks,
                    inflates IDAT, undoes the five scanline filters, and expands
                    to a flat 0xAARRGGBB buffer ready for gui_gfx_blit. A pixel
                    cap guards the heap.
  - Web app: if a response body sniffs as an image it is decoded once and drawn
    instead of text -- scaled to fit the panel width, vertically scrollable,
    alpha-composited over the background. The per-fetch cap grew to 128 KB so
    real images and longer pages fit.

Both decoders were verified on the host against generated references before
going in the kernel: inflate round-trips six zlib/raw streams (empty, back-
references, dynamic Huffman, stored blocks, 20 KB random, mixed); the image
decoder reproduces PIL-made PNGs of every supported colour type -- grayscale,
RGB, RGBA, 4-bit palette, gray+alpha -- and a BMP, with exact pixel matches.
In QEMU the Web app fetched a 360x240 PNG over HTTP and rendered it perfectly:
gradient, an antialiased red circle, a green box, a yellow diagonal, shown as
"image 360x240". Builds clean on x86_64, aarch64 and armv8i.

Still image-by-URL, not inline <img> within a page (that needs sub-resource
fetching and layout); and no JPEG/GIF (different codecs). PNG and BMP cover a
large share of the web's images.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

include/lib/image.h

@@ -0,0 +1,25 @@
+#ifndef _LIB_IMAGE_H
+#define _LIB_IMAGE_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+// Decoded image: a heap-allocated buffer of 0xAARRGGBB pixels, row-major, ready
+// to hand to gui_gfx_blit. Free with image_free.
+typedef struct {
+    int       width;
+    int       height;
+    uint32_t* pixels;
+} image_t;
+
+// True if the bytes begin with a signature this decoder supports (PNG or BMP).
+bool image_sniff(const uint8_t* data, unsigned len);
+
+// Decode PNG (8-bit grayscale/RGB/RGBA/palette, non-interlaced) or BMP
+// (24/32-bit uncompressed) into img. Returns 0 on success. On failure img is
+// left zeroed and nothing needs freeing.
+int  image_decode(const uint8_t* data, unsigned len, image_t* img);
+
+void image_free(image_t* img);
+
+#endif // _LIB_IMAGE_H