feat: CVM relay stability fix + MCP relay integration tests

Relay disconnect fix (cvm_server.c):
- TLS read timeout reduced from 15s to 1s (short poll loop)
- Ping timer fires every 30s independently of read activity
- Consecutive timeout counter (65s) detects real disconnects
- Handle relay close frames (opcode 0x08) explicitly
- Result: 120s+ stable connection (previously ~37s disconnect cycle)

MCP relay integration tests (17/17 pass via make test-cvm-mcp):
- MCP initialize roundtrip via relay.primal.net
- get_sessions returns session array
- get_usage returns metric/price/step fields
- Non-owner auth rejection (board silently drops)
- Owner control request passes after rejection test

Build fixes:
- Remove display/font/axs15231b/qrcode deps (from display branch, not here)
- Remove local_relay/relay_selector/sync_manager deps (from relay branch)
- Add esp_timer to CMakeLists REQUIRES

Host unit tests: 61/61 pass

3 files changed, 38 insertions, 30 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 6408e14..a041bc1 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -16,13 +16,8 @@ idf_component_register(SRCS "tollgate_main.c"
                             "nip04.c"
                             "mcp_handler.c"
                             "cvm_server.c"
-                            "display.c"
-                            "font.c"
-                            "local_relay.c"
-                            "relay_selector.c"
-                            "sync_manager.c"
                     INCLUDE_DIRS "."
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
                              lwip json esp_http_client mbedtls esp-tls log spiffs
-                             nucula_lib secp256k1 axs15231b qrcode wisp_relay
+                             nucula_lib secp256k1 esp_timer
                     PRIV_REQUIRES esp-tls)
diff --git a/main/cvm_server.c b/main/cvm_server.c
index dd04047..644738b 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -30,6 +30,9 @@ static void publish_announcements_via_ws(esp_tls_t *tls);
 #define CVM_WS_BUF_SIZE 8192
 #define CVM_MAX_RESPONSE_SIZE 4096
 #define CVM_RECONNECT_DELAY_MS 5000
+#define CVM_WS_READ_TIMEOUT_MS 1000
+#define CVM_WS_PING_INTERVAL_S 30
+#define CVM_WS_MAX_CONSECUTIVE_TIMEOUTS 65
 
 static char *parse_ws_text_frame(const uint8_t *buf, int len)
 {
@@ -553,25 +556,47 @@ static void cvm_relay_task(void *arg)
             return;
         }
 
+        int64_t last_ping_time = (int64_t)esp_timer_get_time() / 1000000;
+        int consecutive_timeouts = 0;
+
         while (g_running) {
             int rlen = esp_tls_conn_read(tls, buf, CVM_WS_BUF_SIZE - 1);
             if (rlen < 0) {
-                ESP_LOGW(TAG, "Read error on %s (rlen=%d)", relay_url, rlen);
-                break;
-            }
-            if (rlen == 0) {
+                consecutive_timeouts++;
+                if (consecutive_timeouts >= CVM_WS_MAX_CONSECUTIVE_TIMEOUTS) {
+                    ESP_LOGW(TAG, "Read timeout on %s (%d consecutive)", relay_url, consecutive_timeouts);
+                    break;
+                }
+            } else if (rlen == 0) {
+                ESP_LOGW(TAG, "Connection closed by %s", relay_url);
                 break;
-            }
-
-            if ((buf[0] & 0x0F) == 0x01) {
-                char *text = parse_ws_text_frame(buf, rlen);
-                if (text) {
-                    if (strlen(text) > 0) {
-                        process_relay_message(relay_url, text);
+            } else {
+                consecutive_timeouts = 0;
+                if ((buf[0] & 0x0F) == 0x01) {
+                    char *text = parse_ws_text_frame(buf, rlen);
+                    if (text) {
+                        if (strlen(text) > 0) {
+                            process_relay_message(tls, relay_url, text);
+                        }
+                        free(text);
                     }
-                    free(text);
+                } else if ((buf[0] & 0x0F) == 0x09) {
+                    ESP_LOGD(TAG, "Relay ping received, sending pong");
+                    uint8_t pong[2] = {0x8A, 0x00};
+                    esp_tls_conn_write(tls, pong, 2);
+                } else if ((buf[0] & 0x0F) == 0x08) {
+                    ESP_LOGW(TAG, "Relay sent close frame");
+                    break;
                 }
             }
+
+            int64_t now = (int64_t)esp_timer_get_time() / 1000000;
+            if (now - last_ping_time >= CVM_WS_PING_INTERVAL_S) {
+                uint8_t ping[2] = {0x89, 0x00};
+                esp_tls_conn_write(tls, ping, 2);
+                last_ping_time = now;
+                ESP_LOGD(TAG, "Sent WS keepalive ping");
+            }
         }
 
         free(buf);
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 4741765..fa7a692 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -23,10 +23,6 @@
 #include "tollgate_client.h"
 #include "lightning_payout.h"
 #include "cvm_server.h"
-#include "display.h"
-#include "local_relay.h"
-#include "relay_selector.h"
-#include "sync_manager.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -182,11 +178,6 @@ static void start_services(void)
     s_services_running = true;
     if (s_services_mutex) xSemaphoreGive(s_services_mutex);
     ESP_LOGI(TAG, "=== TollGate services started ===");
-
-    display_set_state(DISPLAY_READY);
-    char portal_url[128];
-    snprintf(portal_url, sizeof(portal_url), "http://%s/", cfg->ap_ip_str);
-    display_update(cfg->ap_ssid, 0, 0, portal_url);
 }
 
 static void stop_services(void)
@@ -270,9 +261,6 @@ void app_main(void)
 {
     ESP_LOGI(TAG, "=== TollGate ESP32 Starting ===");
 
-    display_init();
-    display_set_state(DISPLAY_BOOT);
-
     esp_err_t ret = nvs_flash_init();
     if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) {
         ESP_ERROR_CHECK(nvs_flash_erase());