Phase 03: CAM decode coverage, real sensor data in TX, V2X monitor for ESP32 path

CAM codec:
- Stop rejecting CAMs carrying a specialVehicleContainer. It is declared last in
  CamParameters, after everything this decoder reads, so buses / emergency
  vehicles / road-works vehicles now decode for position and kinematics instead
  of being dropped outright
- Drop the lowFrequencyContainer parse - it extracted nothing into Cam, and its
  reads were only correct when no high-frequency optionals were present
- Document why the 7 optional-presence bits are consumed but not acted on: UPER
  writes a SEQUENCE's presence bitmap up front but each field's value in
  declaration order, and all seven are declared after yawRate
- Field widths and container ordering verified against the ETSI ASN.1 sources in
  the C-ITS-Parser checkout, not from memory

Transmit path:
- Own StationID is now a persisted random 32-bit value instead of a hardcoded 0.
  Receivers key on StationID to track a station across CAMs, so every unit
  broadcasting 0 made two MicrOBUs indistinguishable - including to this app's
  own detection engine
- Populate longitudinalAcceleration from successive GNSS speed samples. Not from
  the accelerometer: CAM wants signed along-track acceleration, and the raw
  sensor is device-frame with gravity in it. Null outside a usable sample gap
  rather than a fabricated value
- CAM pinger builds from live GNSS/IMU via PhoneCamBuilder instead of beaconing a
  hardcoded bench coordinate with speed and heading pinned to zero, so it now
  exercises the sensor pipeline and not just the wire. Sends nothing without a
  fix, and reports that rather than sitting at "Sent: 0"

V2X monitor:
- Received-CAM pane for the ESP32-C5 path, replacing the MQTT topic list that is
  permanently empty there. One row per station rather than per message - CAMs
  arrive at 1-10 Hz per station, so the pane is bounded by road users nearby, not
  by traffic rate. Nearest first, tinted by active alert level
- DENM hazard pins on the live map as a warning triangle, drawn above vehicle
  markers. CiT One path only: the ESP32 firmware forwards BTP-B port 2001 (CAM)
  and drops port 2002 before it reaches the phone

DenmParser uses tolerant field-name matching - the Use Case API's DENM JSON
schema is not yet confirmed against real payloads.

app/src/main/java/com/hawhamburg/micr0bu/viewmodel/MqttViewModel.kt

@@ -16,6 +16,8 @@ import com.hawhamburg.micr0bu.data.transport.TransportType
 import com.hawhamburg.micr0bu.data.transport.UsbNetworkDetector
 import com.hawhamburg.micr0bu.data.transport.UsbSerialState
 import com.hawhamburg.micr0bu.data.transport.UsbSerialTransport
+import com.hawhamburg.micr0bu.domain.denm.DenmEvent
+import com.hawhamburg.micr0bu.domain.denm.DenmParser
 import com.hawhamburg.micr0bu.domain.denm.DenmUseCase
 import com.hawhamburg.micr0bu.domain.usecase.UseCaseAlert
 import com.hawhamburg.micr0bu.domain.usecase.UseCaseType
@@ -104,6 +106,9 @@ class MqttViewModel @Inject constructor(
     val camPingerActive: StateFlow<Boolean> = camPinger.isActive
     val camPingerSentCount: StateFlow<Int> = camPinger.sentCount
 
+    /** False while the pinger runs without a GNSS fix — it has no position to build a CAM from. */
+    val camPingerHasFix: StateFlow<Boolean> = camPinger.hasFix
+
     fun startCamPinger() = camPinger.start()
     fun stopCamPinger() = camPinger.stop()
 
@@ -138,6 +143,34 @@ class MqttViewModel @Inject constructor(
         .map { it != null && it != 2 }
         .stateIn(viewModelScope, SharingStarted.Eagerly, false)
 
+    // ── DENM reception (live map hazard pins) ─────────────────────────────────
+
+    /**
+     * Hazards received from other stations, newest first, deduped by [DenmEvent.dedupKey] so a
+     * repeating DENM about the same hazard stays one pin instead of stacking up.
+     *
+     * Derived from the raw `v2x-uca/output/json/denm` messages the repository already buffers,
+     * rather than a second subscription — the repository caps each topic's history, so this is
+     * bounded by construction.
+     *
+     * Always empty on the ESP32-C5 path: that firmware forwards BTP-B port 2001 (CAM) only and
+     * drops DENM before it reaches the phone. See [DenmEvent]'s KDoc.
+     */
+    val denmEvents: StateFlow<List<DenmEvent>> = repo.topicMessages
+        .map { byTopic ->
+            (byTopic[DENM_RX_TOPIC] ?: emptyList())
+                .mapNotNull { DenmParser.parse(it.payload, it.timestamp) }
+                .associateBy { it.dedupKey }   // last write wins = most recent per hazard
+                .values
+                .sortedByDescending { it.timestamp }
+        }
+        .stateIn(viewModelScope, SharingStarted.Eagerly, emptyList())
+
+    private companion object {
+        /** Use Case API topic carrying received DENMs (CiT One path only). */
+        const val DENM_RX_TOPIC = "v2x-uca/output/json/denm"
+    }
+
     // ── DENM transmission ─────────────────────────────────────────────────────
 
     /** True while a DENM use case is actively broadcasting on the OBU. */