feat: Safe Serial Debug Mode for Button & LED Testing

Add an optional compile-time debug mode that enables Serial output and simple Serial commands for hardware testing — without leaking any sensitive data.

**Motivation**

When assembling a new device it's currently hard to verify wiring without flashing a separate test sketch. A built-in debug mode would let users confirm button and LED connections quickly via the Serial monitor.

**Proposed Implementation**

Guarded entirely behind a `#ifdef DEBUG_MODE` flag in `build_config.h`:

```cpp
// build_config.h
// #define DEBUG_MODE // Uncomment to enable serial debug (never in production!)
```

**Serial debug output (read-only, passive):**
```
[DEBUG] Boot OK — stage-2 init done
[DEBUG] Button pressed — duration: 312ms → SHORT
[DEBUG] Button pressed — duration: 720ms → LONG
[DEBUG] Sequence so far: [0, 1]
[DEBUG] Sequence timeout — reset
[DEBUG] Sequence matched — typing... (no plaintext logged)
[DEBUG] Lockout active — 28s remaining
```

**Serial command interface (active testing):**
```
CMD:LED_TEST → runs full LED blink pattern
CMD:BUTTON_PING → prints "Button=HIGH/LOW" (current pin state)
CMD:STATUS → prints lockout counter, sequence length, boot flags
```

**Security constraints:**
- `DEBUG_MODE` is undefined by default — zero overhead in production
- No passwords, plaintext, keys, or EEPROM contents ever printed
- `build.sh` should warn loudly (or abort) if `DEBUG_MODE` is defined when building for release
- Serial commands only active when `DEBUG_MODE` is defined at compile time

**Affected files**
- `build_config.h` — add `DEBUG_MODE` define
- `ESP-ProMicro-HidKey.ino` — wrap Serial calls and command parser in `#ifdef`
- `build.sh` — add release guard check

---

Start with build_config.h, ESP-ProMicro-HidKey.ino, and build.sh, then trace the existing button, LED, Serial, and release-build paths. Done means DEBUG_MODE is off by default, debug output and commands are compile-time gated, sensitive data is never printed, and release builds warn or abort when the flag is enabled.

Written by the indexing model from the issue text.