Guide the enrolment, and take the sample total from the config

Two problems from a real attempt, one mine and one the tool failing to explain
itself.

A sample is taken on the RISING edge only. Holding the finger down produces no
further touch events however long it stays there, so a run with the finger
almost permanently down collects one sample: 55 finger frames across 60, three
touch events, two samples accepted. The loop now says which state it is in on
every line -- press, hold, or LIFT -- shows accepted-of-total as it goes, and
calls out a finger that has been held for several frames, because that is the
state where nothing is happening and nothing on screen said so.

And the total is now read from the config instead of inferred. `rem` is
reported after the sample is processed, so the first reading of a healthy
enrolment is already 9, and a session that takes the first reading as its total
is permanently off by one -- it reported "1 of 9 accepted" when two samples had
been accepted out of ten. common.max_enrolling_samples is stated explicitly in
the generated config so both sides agree on the number rather than one of them
guessing.

Also recorded: not every press is accepted. The third touch of that run
reported the same count as the second, which is the algorithm rejecting a
sample, and is normal.

interfaces/Fingerprintd-Engine.cppm

@@ -132,14 +132,22 @@ export namespace fingerprintd::engine {
     // the value.
     class EnrolSession {
     public:
+        // The total is common.max_enrolling_samples and is KNOWN from the
+        // config, not inferred. Inferring it from the first reading is off by
+        // one: `rem` is reported after the sample has been processed, so the
+        // first observation of a healthy enrolment is already 9, not 10, and a
+        // session that takes 9 as the total reports one fewer accepted sample
+        // than actually happened.
+        explicit EnrolSession(std::int32_t total) : total_(total) {}
+
         void Observe(std::int32_t remaining, bool fromEnrolPath) {
             if (!fromEnrolPath) return;             // a release reports nothing
             if (remaining < 0) return;              // not populated at all
+            if (remaining > total_) return;         // nonsense
             if (!started_) {
                 // A first reading of 0 is an unpopulated field, not a finished
-                // enrolment: the count starts at max_enrolling_samples.
+                // enrolment: the count starts at the total.
                 if (remaining == 0) return;
-                total_ = remaining;
                 remaining_ = remaining;
                 started_ = true;
                 return;
@@ -161,6 +169,8 @@ export namespace fingerprintd::engine {
         bool started_ = false;
         std::int32_t total_ = 0;
         std::int32_t remaining_ = -1;
+        // Set once the total is known; see the constructor.
+
     };
 
     // ---- Authentication accounting ----------------------------------------