Fix SpoolBuddy NFC write failing on NTAG 213/215/216 tags

  Three issues:

  1. SAK gate too strict — NTAG chips can report SAK 0x04 (MIFARE
     Ultralight family) instead of 0x00. Accept both in nfc_reader.py
     and main.py.

  2. TX CRC disabled for NTAG WRITE — the NTAG spec requires CRC on
     the WRITE command frame. Enable TX CRC in ntag_write_page().

  3. TX CRC disabled for NTAG READ — the post-write verification read
     also failed because ntag_read_pages() sent the READ command
     without CRC. Enable TX CRC there too.

CHANGELOG.md

@@ -17,7 +17,7 @@ All notable changes to Bambuddy will be documented in this file.
 - **SpoolBuddy Install Script Now Upgrades System Packages** — The install script now runs `apt-get upgrade -y` after installing required packages and the WiFi safeguard. This ensures the Pi is fully up to date before SpoolBuddy is deployed, and the WiFi safeguard protects connectivity during the upgrade.
 
 ### Fixed
-- **SpoolBuddy NFC Write Fails on NTAG Tags** — Two issues prevented writing to NTAG 213/215/216 tags. First, some chips report SAK `0x04` (MIFARE Ultralight family) instead of `0x00` during anticollision, and the write gate only accepted `0x00`, causing "Incompatible tag type" errors. Both SAK values are now accepted. Second, the PN5180 NTAG WRITE command had TX CRC disabled, but the NTAG spec requires a CRC on the WRITE frame — the tag NAK'd every write attempt with "Write or verification failed". Fixed by enabling TX CRC for WRITE commands (RX CRC stays off since the 4-bit ACK has no CRC).
+- **SpoolBuddy NFC Write Fails on NTAG Tags** — Three issues prevented writing to NTAG 213/215/216 tags. First, some chips report SAK `0x04` (MIFARE Ultralight family) instead of `0x00` during anticollision, and the write gate only accepted `0x00`, causing "Incompatible tag type" errors. Both SAK values are now accepted. Second, the PN5180 had TX CRC disabled for both NTAG WRITE and READ commands, but the NTAG spec requires CRC on all command frames. The tag silently ignored CRC-less commands, failing writes and the post-write verification read. Fixed by enabling TX CRC for both WRITE and READ (RX CRC stays off — the 4-bit WRITE ACK has no CRC, and READ response CRC bytes are safely ignored).
 - **Database Connection Pool Exhaustion on Large Printer Farms** — Users with 100+ printers connected simultaneously experienced `QueuePool limit of size 10 overflow 20 reached, connection timed out` errors. Increased the SQLAlchemy connection pool from 30 total (10 base + 20 overflow) to 220 (20 base + 200 overflow), and raised the SQLite busy_timeout from 5 to 15 seconds to reduce write contention under heavy concurrent MQTT updates.
 - **SpoolBuddy Update Check Always Shows "Up to Date"** — The SpoolBuddy daemon update check compared the device's firmware version against GitHub releases instead of the running Bambuddy backend version. This meant the check could incorrectly report "up to date" even when the daemon was behind. Fixed by comparing directly against `APP_VERSION` from the backend config.
 - **SpoolBuddy Updates Now Use SSH** — Replaced the fragile self-update mechanism (daemon pulls its own code via git, permission errors on `.git/`, hardcoded `main` branch) with SSH-based updates driven by the Bambuddy backend. Bambuddy now SSHes into the SpoolBuddy Pi and runs git fetch/checkout, pip install, systemctl restart, and kiosk browser restart remotely. Updates automatically use the same branch as Bambuddy. SSH key pairing is fully automatic — Bambuddy generates an ED25519 keypair and includes the public key in the device registration response; the daemon deploys it to `authorized_keys` on first connect. The install script creates the `spoolbuddy` user with a bash shell and sudoers entries for daemon and kiosk restart. A "Force Update" button allows re-deploying even when versions match. The SSH public key is also shown in SpoolBuddy Settings → Updates → SSH Setup for manual pairing if needed.

spoolbuddy/daemon/pn5180.py

@@ -377,10 +377,9 @@ class PN5180:
         """Read NTAG pages (4 bytes each). No authentication required.
 
         Uses NTAG READ command (0x30) which returns 4 pages (16 bytes) at a time.
-        CRC must be disabled for NTAG reads.
         """
-        # Disable CRC for NTAG
-        self.write_reg_and(0x19, 0xFFFFFFFE)  # TX CRC off
+        # NTAG READ needs TX CRC on (tag expects CRC), RX CRC off (response includes raw CRC bytes we ignore)
+        self.write_reg_or(0x19, 0x01)  # TX CRC on
         self.write_reg_and(0x12, 0xFFFFFFFE)  # RX CRC off
 
         result = bytearray()
@@ -475,7 +474,7 @@ class PN5180:
         """Write 4 bytes to a single NTAG page.
 
         NTAG WRITE command: 0xA2 + page_number + 4 bytes data.
-        CRC disabled (same as reads). Returns True on ACK (0x0A).
+        TX CRC on (tag requires it), RX CRC off (ACK is 4-bit). Returns True on ACK (0x0A).
         """
         if len(data) != 4:
             return False