ISSUE-4073: Fix RPC app crash on BLE/USB disconnect (fixes #4073)

[herbenderbler]

Description

Fixes #4073 — RPC app crash and lost pairing when BLE (or USB) disconnects while an app is running in RPC mode (e.g. Sub-GHz started from a companion app).

Root cause

On disconnect, the transport calls rpc_session_close(). Session teardown runs rpc_system_app_free(), which notifies the app with RpcAppEventTypeSessionClose and then frees RpcAppSystem. The app thread could still be inside rpc_system_app_confirm() → rpc_send(), leading to use-after-free of rpc_app and rpc_app->session and a furi_check crash.

Solution

• rpc_session_wait_send_done(RpcSession*) (in rpc.c): Acquires and releases the session callbacks_mutex. Because rpc_send() uses the same mutex, this ensures no thread is in the middle of an RPC send when it returns.
• rpc_system_app_free() (in rpc_app.c): After the app clears its callback (and the existing while(rpc_app->callback) loop exits), we call rpc_session_wait_send_done(rpc_app->session) before free(rpc_app), so we never free the app context while a send is in progress.

Existing behavior is unchanged: apps still get RpcAppEventTypeSessionClose, clear their callback, and stop (SubGhz, NFC, LFRFID, etc. already handle this). The fix only orders teardown so in-flight sends complete before the context is freed.

Verification

• Firmware builds successfully (./fbt).
• Manual test: start an RPC app (e.g. Sub-Ghz over BLE), disconnect (e.g. put Flipper in microwave or unplug USB); the device should no longer crash and pairing should be preserved.

Checklist (For Reviewer)

• PR has description of feature/bug or link to Confluence/Jira task
• Description contains actions to verify feature/bugfix
• I've built this code, uploaded it to the device and verified feature/bugfix