Slot-bounds checks ignore tlv_len: jump_app, slot_manager and recovery accept an image whose TLV area runs past the slot #150

stage1/jump_app.c, core/slot_manager.c and core/recovery.c each check hdr_size + image_size <= slot_size on their own, but none counts tlv_len. A header with image_size = slot_size - hdr_size and tlv_len = 1 passes the check, and TLV processing then reads past the end of the slot.

Reproduced on master: test_tlv_beyond_slot_rejected_before_payload_read (PR #109) fails at test_jump_app_bounds.c:205 with master's jump_app.c.

Fix: a single overflow-safe eos_image_fits_slot() that counts hdr + image + tlv, used by all three callers.