Add validated SAI/O2 device-flag checkbox editor

Reversed the device-flag mechanism (l.java lc() + ee bit logic) and validated the
flag locations against a real reference map: 20188Map2009AIRBOXBONNY (explicitly
"NO SAI, NO O2 SENSORS"). Diffing its flat ROM vs stock 20188 isolated exactly
three byte-boolean flags that flip 1->0:

  0x53801  SAI            (= base + fe[33] + 0x00)
  0x53818  O2 sensor      (+ 0x17)
  0x53819  O2 sensor (2)  (+ 0x18)

1 = enabled, 0 = disabled. Neither stock map could reveal these (both have SAI+O2
on); the delete map was the key. See research/reference-maps/DEVICES.md.

Viewer: the Triumph-tables tab now has a Device flags panel — checkboxes reflect
the loaded map's real state (stock: all on; delete map: all off), toggling flips
the byte, and "Export edited .hex" re-encodes the distribution format. The
decode->edit->encode round-trip is byte-exact (verified). The caXX header bytes
are map-ID metadata, not a cal checksum; the ECU-flash checksum is applied at
write time.

tunie/viewer/build_viewer.py

@@ -99,6 +99,14 @@ def _extract_romdefs(args) -> dict:
         "sa": arr("s", "a"),
         "tables": [{"name": n, "fe": f, "kind": k} for n, f, k in _TABLE_DEFS],
         "rows": 32, "cols": 20, "rpmFe": 8, "throttleFe": 27,
+        # Device-enable flags: byte at base + fe[33] + rel (1=on, 0=off).
+        # Validated against a NO-SAI-NO-O2 reference map (see research DEVICES.md).
+        "deviceFe": 33,
+        "devices": [
+            {"name": "SAI (Secondary Air Injection)", "rel": 0x00},
+            {"name": "O2 sensor", "rel": 0x17},
+            {"name": "O2 sensor (2)", "rel": 0x18},
+        ],
     }