feat(json): JSON for apps through vendored lua-cjson

lua-cjson decodes straight onto the Lua stack, so a response costs its
text plus the table it becomes rather than a document in between, and it
brings the encode half that a C tokenizer would have left to write here.

It is a module rather than a global: a global namespace is a contract a
firmware implements, and nothing about this needs a provider. Registering
into package.preload also puts it ahead of the SD-card searcher, so an
implementation cannot be shadowed, and an app that never requires it
never pays for the module.

Depth is capped at 32 through the module's own knobs rather than by
patching the vendored source. Decoding recurses on the C stack and
upstream defaults to 1000, which assumes a server rather than a FreeRTOS
task.

lua/api/lib/cjson.lua

@@ -0,0 +1,27 @@
+---@meta cjson
+
+-- Hand-written, unlike the rest of lua/api: the implementation is lua-cjson under
+-- native/src/vendor/cjson, so there are no binding annotations to generate from.
+-- Depth is capped at 32 in native/src/bindings/lib/cjson.cpp, because decoding
+-- recurses on the C stack and the upstream default of 1000 assumes a server.
+--
+-- Both functions raise on bad input rather than returning nil plus a message, so
+-- a response from the network is worth a pcall.
+
+---@class CJsonLib
+local cjson = {}
+
+---The value a JSON null decodes to, distinct from nil so a key survives it.
+cjson.null = nil
+
+---Parses JSON text.
+---@param text string
+---@return any value Tables, strings, numbers, booleans, or cjson.null.
+function cjson.decode(text) end
+
+---Serializes plain Lua data as JSON.
+---@param value any Sequences become arrays; every other table becomes an object.
+---@return string text
+function cjson.encode(value) end
+
+return cjson