fix(mesh): plug pooled-object and driver leaks in core paths (#11450)

- MeshService::sendQueueStatusToPhone: release the pooled QueueStatus
  when the toPhone queue enqueue fails, matching what
  sendMqttMessageToClientProxy and sendClientNotification already do.
  The full-queue guard makes this failure rare, but the check/enqueue
  sequence is not atomic and this path is reachable concurrently from
  the main loop and the nRF52 BLE write callback; each failure
  permanently lost one of the four pool slots, and after four losses
  the phone never receives QueueStatus again until reboot.

- MessageStore::storeTextInPool: bail out when the boot-time pool
  allocation failed instead of memcpy'ing through a null pointer. The
  read side (getTextFromPool) already guards and maps offset 0 to an
  empty string.

- RF95Interface: hold the RadioLibRF95 driver in a unique_ptr. It is
  constructed in init(), and when init() subsequently fails (e.g. chip
  probe NOT_FOUND) initLoRa() destroys the interface, leaking the
  driver; every sibling interface holds its driver by value so nothing
  else needed a destructor here.

src/mesh/MeshService.cpp

@@ -353,6 +353,8 @@ ErrorCode MeshService::sendQueueStatusToPhone(const meshtastic_QueueStatus &qs,
     lastQueueStatus = *copied;
 
     res = toPhoneQueueStatusQueue.enqueue(copied, 0);
+    if (!res)
+        releaseQueueStatusToPool(copied);
     fromNum++;
 
     return res ? ERRNO_OK : ERRNO_UNKNOWN;