fix(mesh): plug pooled-object and driver leaks in core paths (#11450)

- MeshService::sendQueueStatusToPhone: release the pooled QueueStatus
  when the toPhone queue enqueue fails, matching what
  sendMqttMessageToClientProxy and sendClientNotification already do.
  The full-queue guard makes this failure rare, but the check/enqueue
  sequence is not atomic and this path is reachable concurrently from
  the main loop and the nRF52 BLE write callback; each failure
  permanently lost one of the four pool slots, and after four losses
  the phone never receives QueueStatus again until reboot.

- MessageStore::storeTextInPool: bail out when the boot-time pool
  allocation failed instead of memcpy'ing through a null pointer. The
  read side (getTextFromPool) already guards and maps offset 0 to an
  empty string.

- RF95Interface: hold the RadioLibRF95 driver in a unique_ptr. It is
  constructed in init(), and when init() subsequently fails (e.g. chip
  probe NOT_FOUND) initLoRa() destroys the interface, leaking the
  driver; every sibling interface holds its driver by value so nothing
  else needed a destructor here.

src/MessageStore.cpp

@@ -42,6 +42,10 @@ static inline void resetMessagePool()
 // If not enough space remains, wrap around (ring buffer style)
 static inline uint16_t storeTextInPool(const char *src, size_t len)
 {
+    // Pool allocation can fail at boot; getTextFromPool() already maps offset 0 to "" in that case
+    if (!g_messagePool)
+        return 0;
+
     if (len >= MAX_MESSAGE_SIZE)
         len = MAX_MESSAGE_SIZE - 1;