Constrain terminal layout and externalize TLS memory

Improve CSP and favicon handling while preventing terminal resize loops.
Configure mbedTLS allocations in external PSRAM and document its
security implications.

sdkconfig.defaults

@@ -6,6 +6,11 @@ CONFIG_SPIRAM_SPEED_80M=y
 CONFIG_SPIRAM_BOOT_INIT=y
 CONFIG_SPIRAM_USE_CAPS_ALLOC=y
 
+# Keep concurrent HTTPS handshakes from exhausting scarce internal DRAM.
+# Active TLS material remains unencrypted in PSRAM until the hardening phase.
+CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
+# CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
+
 # Native USB OTG presents one CDC-ACM interface on the ESP32-S3 USB port.
 CONFIG_TINYUSB_CDC_ENABLED=y
 CONFIG_TINYUSB_CDC_COUNT=1