Add the authentication loop

Arms a scan session and drives the frame loop: capture, decide finger from the
calibrated floor, report the touch edges, classify the verdict.

It needs no writes of any kind -- no SAVE_DATA, no RPMB write, no SFS write --
so it runs safely against an existing template with the store read-only. That
is what makes it the right thing to try before enrolment rather than after.

Verified armed on the phone: the template loads, the floor calibrates, and
AUTHENTICATE returns rc=0, which also proves the gid agrees with the one
SET_ACTIVE_GROUP used (a mismatch answers -200). With no finger present the
loop correctly reports nothing: no touch edge, no event, no terminal frame.

The fid field is poisoned before every REPORT_EVENT, because a zero-initialised
buffer cannot distinguish "the matcher never ran" from "the matcher ran and
rejected" -- the failure path writes zero there too.

The tally reports terminal frames as the denominator and presses separately,
so a run cannot be read as having rejections it did not have.

interfaces/Fingerprintd-Ta.cppm

@@ -32,6 +32,7 @@ export namespace fingerprintd::ta {
         SyncStatistics  = 0x100e,
         StartScanning   = 0x1012,
         CaptureImage    = 0x1013,
+        QueryEventStatus = 0x101d,
         SaveData        = 0x1014,
         ReportEvent     = 0x1018,
         WorkMode        = 0x1020,