pandad: protect app firmware from recover, keep blank-board flashing

The SPI panda boot loop called recover_internal_panda() whenever the panda
did not appear within 20s after a reset. recover() erases both the bootstub
and app sectors (dfu.py program_bootstub erases sectors 0+1) before
reflashing, so a working panda that booted slowly lost its app firmware.

Fix:
- pandad.py: wait up to 60s for the panda, retry the normal reset 3x, and
  only enter the ROM bootloader (recover) when the panda is confirmed in DFU
  or all normal resets failed - preserving provisioning of blank boards.
- hardware.py: align recover_internal_panda() timing with the working manual
  flash scripts (0.2s reset hold, 1s settle, keep BOOT0 high).
- spi.py: raise the SPI bootloader ack timeout from 0.01s to 0.1s so the DFU
  flash reliably succeeds instead of erasing then failing.

panda/python/spi.py

@@ -328,7 +328,7 @@ class STBootloaderSPIHandle(BaseSTBootloaderHandle):
       # sync + command
       spi.xfer([self.SYNC, ])
       spi.xfer([cmd, cmd ^ 0xFF])
-      self._get_ack(spi, timeout=0.01)
+      self._get_ack(spi, timeout=0.1)
 
       # "predata" - for commands that send the first data without a checksum
       if predata is not None: