Expert install block erases into the rootfs on 16MB NOR

[openipc-ai]

Camera#overlay_offset keys the rootfs_data offset on the firmware variant, but the real U-Boot partition table keys it on flash size:

def overlay_offset
  case firmware_version
  when 'lite'     then '0x750000'
  when 'ultimate' then '0xD50000'
  else '0x750000'
  end
end

Against the actual partition tables:

mtdpartsnor8m   256k(boot),64k(env),2048k(kernel),5120k(rootfs),-(rootfs_data)
                rootfs 0x250000..0x750000   rootfs_data 0x750000
mtdpartsnor16m  256k(boot),64k(env),3072k(kernel),10240k(rootfs),-(rootfs_data)
                rootfs 0x350000..0xd50000   rootfs_data 0xd50000

The two agree only for the historical pairings 8M+lite and 16M+ultimate. They diverge for 16M+lite — and app/views/cameras/socs/show.html.erb forces lite whenever nor16m is selected:

} else if (document.querySelector('#camera_flash_type').value === 'nor16m') {
    for (...) { o.disabled = (o.value !== 'lite'); }
    el.value = 'lite';
}

So 16M+lite is the combination every 16MB NOR camera actually gets, and it receives the 8MB offset.

Measured

On dev.openipc.org, image 16a1d9a:

nor16m / lite:      overlay_offset=0x750000  size=0x8b0000
nor16m / ultimate:  overlay_offset=0xD50000  size=0x2b0000

actual 16MB lite image for hi3518ev200: rootfs occupies 0x350000..0x803000
-> `sf erase 0x750000 0x8b0000` starts 733184 bytes inside the rootfs

The emitted block is, in order:

run uknor16m; run urnor16m
sf erase 0x750000 0x8b0000
reset

So the erase runs immediately after urnor16m has written the rootfs, and takes out its last ~716KB.

Scope

This is in the collapsed "Advanced installation instruction for experts" section, so it is not the primary path — but it is reachable, documented, and wrong for the most common 16MB configuration.

rootfs_offset and rootfs_max_size have the same variant-keyed shape and the same latent mismatch; they are only used by the SD-card branch of flashing_linux, which is why they have not bitten in the same way.

Suggested fix

Derive these from the flash size rather than the variant — the same correction #59 applied to the NAND branch of those methods. Roughly:

	8M	16M / 32M
rootfs_offset	0x250000	0x350000
rootfs_max_size	0x500000	0xA00000
overlay_offset	0x750000	0xD50000

Found while validating #59 on dev. Pre-existing and unrelated to that PR, so it was deliberately left out of its diff.