… BSP with ci-attach

The N32H47x_48x and N32H49x series share drv_tim.c with N32H7xx, but only the
H7xx branch was ever implemented, so clock timer, LPTIM, PWM and pulse encoder
built to nothing on n32h487zgl7-evb and n32h497zgl7-evb.  This adds those
branches and gives all three boards a ci-attach entry set that actually
compiles what the drivers claim to support.

Drivers

  - drv_tim.c gains the H47x_48x/H49x clock-source and clock-enable branches,
    the ATIM/GTIM/BTIM instance tables and n32_tim_clock_freq_get(), which
    reads the real PCLK/HCLK/SYSCLK back from RCC rather than assuming one.
    ATIMCLKSEL is inverted between the two families and is handled as such.
  - drv_lptim.c derives its tick from the real LSI value instead of a
    hard-coded one, unlocks the backup domain before touching RCC, latches
    the prescaler, and returns -RT_EINVAL rather than clamping a bad rate.
  - drv_pwm.c and drv_pulse_encoder.c are extended to the H47x_48x/H49x
    instances; the H7xx encoder's update event is cleared through
    TIM_EnableUpdateEvt() because that family has no TIM_ConfigUpdateEvt().
  - config/{h47x_48x,h49x}/{tim,pwm,pulse_encoder,lptim}_config.h are new and
    enumerate the instances each series has, for the existing drivers to read.

Kconfig

Each board defines the timer menus in its own board/Kconfig, so that a
board's peripheral options live with the board and the shared driver
Kconfig stays series-neutral; libraries/N32_Drivers/drivers/Kconfig is
byte-identical to upstream/master.  All three copies enforce the mutual
exclusion drv_pulse_encoder.c documents (a timer instance enabled for both
clock timer and pulse encoder collides at link time on the shared ISR
symbol); N32H7xx's menus had none at all and are brought in line.

ci-attach

51 entries across the three boards (17/16/18).  h487 carries three NAND
entries - peripheral.nand, peripheral.nand_16b and peripheral.nand_large -
and h497 and h760 carry one each.  peripheral.nand_large exists because
drv_nand.c picks the row-address cycle count from pages_per_block *
block_count: 2 cycles up to 65536 pages, 3 up to 16777216, else 4.  Every
other NAND entry takes the Kconfig default 64 * 1024 = 65536, which lands
exactly on the first boundary, so the >= 3 and >= 4 arms were compiled by
nothing at all - it takes a geometry past the 24-bit row width to reach the
top rung.  The entry pins that geometry to arm them; it is not a claim about
the part on the board.

Fixes carried in the same series

  - drv_nand.c emitted its third row-address byte under `== 3`, so a 4-cycle
    part would set the count to 4 and then match no emitter, dropping the
    high row-address bytes outright.  The three guards are now >= 3 with the
    >= 4 byte added.  row_addr is uint32_t at all three sites.
  - timer_ctrl() wrote the prescaler straight to a 16-bit PSC field.
    TIM_ConfigPrescaler() neither masks nor validates, so any freq below
    timer_clock/65537 was truncated and the timer ran at an unrelated rate
    while timer->freq still recorded the requested one.  That window is
    reachable: both boards clock timers at 240 MHz, so the honest floor is
    ~3662 Hz while tim_config.h sets minfreq = 3000 and only [minfreq,
    maxfreq] is checked - 3000 Hz lands in PSC as 14463, about 16.6 kHz.
    Division by zero and any prescaler above 0xFFFF now return -RT_EINVAL.
    The H7xx branch had the identical truncation, so the same two guards
    are applied there too.
  - n32_tim_enable_clock() closed each new branch with RT_ASSERT(RT_TRUE).
    With RT_DEBUGING_ASSERT on, RT_ASSERT() expands to `if (!(EX))
    rt_assert_handler(...)`, so that guard could never fire: a timer
    matching none of the branch's instances enabled no clock at all and
    the caller went on to touch an unclocked peripheral's registers.  All
    three branches are now RT_FALSE.  The H7xx guard cannot fire today -
    every instance its config header can hand out is already in that
    branch's ladder - so fixing it arms the guard against a future
    instance added to the table but not the ladder, rather than changing
    any existing configuration.
  - h497's sdram entry asked for BSP_SDRAM_SIZE=32 while sdram_port.h
    documents the part as 8 MB and board/Kconfig declares `range 8 256` with
    `default 8`; the 32 came from h760, whose own default happens to be 32.
  - drv_hard_i2c.c had no init path at all for H47x_48x/H49x, leaving those
    series with an unconfigured controller; the SCL rate now travels in the
    config struct instead of being assumed.
  - drv_qspi.c and drv_spi.c indexed buffers longer than 65535 bytes with
    16-bit counters, which wraps at exactly 65536.
  - n32eth_cfg.h is added because the H7xx and H49x SDKs' eth.h include it
    but no package in the tree ships it.  It probes for the series headers
    because the SDK includes it before rtconfig.h can define SOC_SERIES_*,
    with a part-macro fallback for ARM Compiler 5, which has no
    __has_include() and is what every Keil project in this BSP uses.
  - n32h487zgl7-evb now builds with its real 8 MHz crystal; left at the
    header's 16 MHz default, RCC_GetClocksFreqValue() reports every clock at
    twice its value and the timer prescalers come out twice too large.
  - n32h760zil7-stb's timer menus had no mutual exclusion at all, so a timer
    instance could be enabled as both a clock timer and a pulse encoder; 24
    ISR symbols are defined by both drivers under those two guards, so only
    the linker would have caught it.  Its 14 PWM menus and its 14 encoder
    entries now carry the same guard as the two new boards', using the
    PWMn == PULSE_ENCODERN == instance n mapping that config/h7xx's
    pulse_encoder_config.h establishes.  On the PWM side that guard is a
    resource guard, not a link one: drv_pwm.c defines no ISRs.
  - the same board's LPTIM menu selected RT_USING_LPTIMER, which is not
    declared anywhere in the tree.  A select of an undeclared symbol is an
    implicit symbol and raises no diagnostic, so the line had never done
    anything; it is dropped, as the two new menus already do.  Three stm32
    boards still carry it and are left alone.

The H49x LPTIM EXTI lines needed the user manual rather than the SDK to
settle, and the manual sides with the driver: N32H49x maps EXTI line 21 to
the LPTIM1 wakeup event and line 22 to LPTIM2, which is what
n32_lptim_get_exti_line() returns.  The headers disagree only because
n32h49x_exti.h's EXTI_LINE16..24 block is a verbatim copy of
n32h47x_48x_exti.h's - that one carries on past line 24 and names 25/26 as
the LPTIM events with 21/22 as COMP1/COMP4 - while the H49x series has no
comparator in its SDK at all, so its copy of that text is stale.  The
driver states the reasoning in a comment rather than the bare value.

The H49x timer clock-source bits needed the user manual rather than the SDK
to settle.  For GTIM8/9/10 (RCC_CFG2 bit 27) h49x names the cleared case
RCC_GTIM_CLKSRC_SYSCLKDIV where h47x_48x names it RCC_GTIM_CLKSRC_PCLK, and
the manual sides with the driver's arithmetic: bit 27 selects SYSCLK, or
SYSCLK/(APB2 prescaler / 2) when that prescaler is engaged - the same rule
the driver writes from the HCLK side as PCLK2 doubled whenever PCLK2 is
below HCLK.  Both boards hold AHBPRES at RCC_SYSCLK_DIV1, so HCLK and SYSCLK
are the same 240 MHz and either spelling gives the same number.  The driver
tests the raw bit and not either family's constant, so the naming difference
never reaches the code.  The same chapter confirms bit 28's inversion, which
the ATIM branches already follow.

Verified: all three boards build from scratch under --strict (gcc -Werror)
with zero diagnostics; all 51 ci-attach entries build clean; the three
series were rebuilt after the assert fix, each through the --attach path
that compiles its branch (devices.timer on all three boards - h760's
default leaves BSP_USING_CLOCK_TIMER off, so drv_tim.c is not compiled by
it at all), rebuilt again after the Kconfig guards, whose
effect was checked by loading the tree with kconfiglib and confirming that
clock-timer ATIM1 with pulse encoder1 goes from satisfiable to unsatisfiable
while a non-colliding pair is left alone); the NAND row-address arms were
confirmed compiled by injecting #error markers and rebuilding through the
real --attach path; each board's committed .config and rtconfig.h reproduce
byte-for-byte from a fresh defconfig; and the CI clang-format gate reports
0 files / 0 lines.