vPLASMA: fold in the real ROM fonts and firmware-confirmed commands

Replaces the guessed font/cursor model with what the firmware dump proved:

- The 8 real Babcock ROM fonts, extracted from tms27pc512.BIN into
  PlasmaFonts.cs (6x8, 6x10, 7x10, 12x16, 12x20). Drops the public-domain
  5x7 stand-in and PlasmaFont.cs.
- Pixel-addressed cursor with the real positioning commands: ESC Q (row Y,
  0-31) and ESC R (column X, 0-127), matching the firmware's range checks.
  Cursor motion (BS/HT/LF/VT/CR) now moves by font pixels, not cells.
- ESC K selects fonts 0-7 (out-of-range ignored, per firmware); ESC H
  attributes are the low 4 bits (half/underline/reverse/flash).

Deferred (documented in FIRMWARE.md): the 10 double-buffered pages
(ESC I/i) and vector-graphics primitives (ESC A-F); vPLASMA keeps a
single-page model for now.

Verified: 24 unit tests pass; the three self-test pages render the real
glyphs (big font 4 banner, full charset in font 0, graphics). Next: begin
the modern-parts hardware replica, with this as the reference firmware.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/VPlasma.Core/Protocol/PlasmaProtocol.cs

@@ -58,6 +58,11 @@ public static class PlasmaProtocol
     public const byte CmdFontSelect = (byte)'K';
     public const byte CmdHomeCursor = (byte)'L';
     public const byte CmdGraphicsWrite = (byte)'P';
+    // Cursor positioning, confirmed from the firmware dump (FIRMWARE.md): the
+    // cursor is a pixel position, ESC Q sets its row (Y, 0-31) and ESC R its
+    // column (X, 0-127) — the exact range checks the firmware enforces.
+    public const byte CmdSetRow = (byte)'Q';
+    public const byte CmdSetColumn = (byte)'R';
 
     /// <summary>Operand meaning "restore the default" for ESC K / ESC H.</summary>
     public const byte OperandDefault = 0xFF;