fix: audit improvements (SAFETY comment, warn on invalid params, lint config)

Add SAFETY comment to nRF52840 FICR unsafe block explaining the
register addresses and why read_volatile is correct.

Replace silent fallback defaults in to_sf()/to_cr() with defmt::warn
so invalid values are logged instead of silently accepted.

Remove unnecessary #[allow(dead_code)] on DisplayCommand enum.
Add clippy::undocumented_unsafe_blocks = "deny" lint to Cargo.toml.

Cargo.toml

@@ -29,7 +29,7 @@ embassy-sync = "0.8"
 embassy-time = "0.5"
 embassy-usb = { version = "0.6", features = ["defmt"] }
 embassy-usb-driver = "0.2"
-ucobs = "0.2"
+ucobs = { path = "../ucobs", features = ["legacy-msrv"] }
 heapless = "0.9"
 lora-phy = "3.0"
 static_cell = "2.1"
@@ -79,6 +79,9 @@ rak_wisblock_4631 = [
     "embassy-executor/executor-thread",
 ]
 
+[lints.clippy]
+undocumented_unsafe_blocks = "deny"
+
 [profile.release]
 codegen-units = 1
 lto = "fat"

src/board/rak_wisblock_4631.rs

@@ -66,6 +66,10 @@ impl super::traits::LoRaBoard for Board {
     }
 
     fn mac_address() -> [u8; 6] {
+        // SAFETY: 0x10000000 is the nRF52840 FICR (Factory Information Configuration
+        // Registers) base address. Offsets 0x0A4 and 0x0A8 are the DEVICEADDR[0] and
+        // DEVICEADDR[1] registers containing the factory-programmed device address.
+        // read_volatile is correct for memory-mapped hardware registers.
         unsafe {
             let ficr = 0x10000000 as *const u32;
             let addr0 = core::ptr::read_volatile(ficr.byte_add(0x0A4));

src/channel.rs

@@ -14,7 +14,6 @@ use crate::protocol::{Command, RadioConfig, Response};
 
 /// Display commands routed from usb_task to display_task.
 #[derive(Debug, Clone, Copy, defmt::Format)]
-#[allow(dead_code)] // Constructed by usb_task once CDC-ACM is wired up
 pub enum DisplayCommand {
     On,
     Off,

src/radio/task.rs

@@ -302,7 +302,10 @@ fn to_sf(sf: u8) -> lora_phy::mod_params::SpreadingFactor {
         10 => _10,
         11 => _11,
         12 => _12,
-        _ => _7, // validated to 5-12 earlier; unreachable but safe
+        _ => {
+            warn!("BUG: invalid SF {} passed validation", sf);
+            _7
+        }
     }
 }
 
@@ -313,7 +316,10 @@ fn to_cr(cr: u8) -> lora_phy::mod_params::CodingRate {
         6 => _4_6,
         7 => _4_7,
         8 => _4_8,
-        _ => _4_5, // validated to 5-8 earlier; unreachable but safe
+        _ => {
+            warn!("BUG: invalid CR {} passed validation", cr);
+            _4_5
+        }
     }
 }