feat(radioHardware): save through update_radio_hardware_config

[npdgm]

Problem

The Radio Hardware tab saves through ApiService.importConfig → /api/config_import. That endpoint is auth-exempt for first-run restore and never sees an authenticated user, so on a configured node every save returns 403 "Unauthorized restore" — masked as "Unknown error occurred" because handleError only understands axios errors, not the HttpResponse objects thrown by the generated fetch client (src/generated/openapi.ts: if (!response.ok) throw data).

The tab also only sent the form's visible pin fields: preset fields without widgets (use_dio3_tcxo, use_dio2_rf, gpio_chip, ...) were silently dropped — a Station G3 configured from the tab would lose its TCXO settings.

Change

• Save through the new authenticated POST /api/update_radio_hardware_config (generated client refreshed from the repeater openapi.yaml via npm run api:generate). With a board preset selected the payload is {hardware_key, overrides}: the backend applies the full preset — hidden fields included — and the visible form fields ride along as overrides (values equal to the preset are no-ops, deliberate edits win). Without a preset the payload stays {radio_type, <section>} (manual mode).
• applyBoardPreset() resets fields absent from the preset to neutral defaults instead of keeping the previous board's values, so the form always reads "preset + deliberate edits" and a stale txen_pin can't leak into the new board.
• New read-only "Preset-managed settings" block under the preset dropdown, listing every preset field that has no editable widget. Server-applied values become visible, and a preset field added upstream shows up automatically with no UI change. The note warns that presets defining tx_power/preamble_length override those Radio Settings values on save.
• handleError() fix: surfaces the server's error message from non-2xx responses thrown by the generated client (body in .error), instead of the generic "Unknown error occurred". This benefits every generated-client call, not just this tab. Note this changes user-visible error strings globally (e.g. 401s now read "Unauthorized - Valid JWT or API token required").

Depends on

Backend PR adding the endpoint: openhop-dev/openhop_repeater#384

Test plan

• npm run type-check clean
• eslint — zero new findings (9 pre-existing no-explicit-any on untouched lines, present on dev)
• vitest — 200 passed, 1 pre-existing failure on dev (nav styles, unrelated)
• npm run api:generate output committed (api:check stays green against the backend branch)