ch32h417: fix USB3 fallback storm, SET_ADDRESS deref, status-stage completion

Apply correctness-review findings on the USBSS SuperSpeed dcd (still pre-hardware):

- Critical: the LINK DISABLE fallback path left TIM12 running, so once the driver
  switched to USB2 (where the ISR routes to the USB2 handler and never clears the
  timer flag) the update flag stormed the CPU. Both fallback entry points now go
  through fallback_to_usb2(), which stops TIM12 first.
- Critical: dcd_set_address in fallback mode called ch32h417_usb2_edpt0_status_complete
  with a NULL request (dereferenced immediately) and fell through into the USB3 path.
  It now arms the USB2 status ZLP and returns; the address is applied by the USB2
  status-complete callback usbd invokes with the real request.
- Major: the control STATUS stage (USBSS_UDIF_STATUS) never completed the queued
  zero-length status transfer, so usbd's status-stage callback never ran and EP0
  stayed busy. The status ZLP does not raise a UIF_TRANSFER on this controller, so it
  is now completed in the UDIF_STATUS branch (and handle_ep0_in no longer completes a
  zero-length IN early).
- Also: LINK_STATE_INACTIVE now counts toward the fallback attempt limit (matches the
  file header and the vendor), the LINK_CFG init uses LINK_TX_DEEMPH_MASK exactly like
  the WCH EVT literal, and a dead if/else in the EP0-OUT arm path is collapsed.

Build-verified: both full example matrices (SPEED=super and =high) build 20/20.
Remaining review notes (U1/U2/U3 PHY low-power reconfig, RECOVERY case, SET_ISOCH_
DELAY -> LINK_ISO_DLY, OUT-DMA clamp) are deferred to hardware bring-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhrtHjbSVMKcY68vxBwBm