build: document Pi firmware build/flash + gplan.so cross-build via Stretch Docker

- .pi/BUILD.md: end-to-end macOS dev workflow, deploy paths, dphys-swapfile vs fstab, troubleshooting.
- .pi/Dockerfile.gplan + build-gplan.sh: rebuild gplan.so from source on Raspbian Stretch (Bullseye is too new for the toolchain).
- Makefile: ensure trailing newline between concatenated pug templates so Pug doesn't glue file boundaries together.

.pi/build-gplan.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build gplan.so for the Onefinity Pi (armv7l, Python 3.5, GCC 6.3)
+#
+# Uses a Raspbian Stretch Docker image that exactly matches the Pi's
+# toolchain. No cross-compile, no relink hacks, no GLIBC mismatches.
+#
+# First run:   ~30min  (builds Docker image with cbang + camotics)
+# After that:  ~1sec   (copies pre-built gplan.so from image)
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+IMAGE="onefin-gplan"
+OUTPUT="$PROJECT_DIR/src/py/camotics/gplan.so"
+
+# Build image if needed (one-time)
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+    echo "Building $IMAGE Docker image (one-time, ~30min under QEMU)..."
+    docker build -t "$IMAGE" -f "$SCRIPT_DIR/Dockerfile.gplan" "$SCRIPT_DIR"
+fi
+
+# Copy gplan.so out of the image
+echo "Extracting gplan.so..."
+docker run --rm -v "$PROJECT_DIR:/workspace" "$IMAGE" \
+    bash -c 'cp /opt/camotics/gplan.so /workspace/src/py/camotics/gplan.so && \
+             file /workspace/src/py/camotics/gplan.so && \
+             readelf -d /workspace/src/py/camotics/gplan.so | grep -E "NEEDED|python"'
+
+echo "✓ Built: $OUTPUT"