Address PR #233 review feedback

- itoa16_html: add comment that the function is sufficient for VLAN
  IDs (<=4094); generalization not needed.
- send_vlanlist: replace post-write bounds check with a pre-write
  guard using worst-case entry size (138 bytes + 1 for closing
  bracket). Old comment claimed ~45 bytes per entry, which only
  held for short names. With a 117-char name (the actual bound from
  CMD_BUF_SIZE) entries can reach 138 bytes, and the post-check
  would not have prevented an overflow.
- Document the 0x02 check in sfr_data[0] as the VLAN table entry
  valid flag.

httpd/page_impl.c

@@ -97,7 +97,7 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }
 
-void itoa16_html(uint16_t v)
+void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
@@ -842,8 +842,9 @@ void send_cmd_log(void)
 
 void send_vlanlist(void)
 {
-	/* Worst case per entry: {"id":4094,"name":"<name>"}, ~45 bytes.
-	 * HTTP header ~50 bytes. TCP_OUTBUF_SIZE=2500 fits ~53 VLANs safely. */
+	/* Worst case per entry: {"id":4094,"name":"<117-char name>"} = 138 bytes
+	 * (name bound: CMD_BUF_SIZE=128 minus command prefix); +1 for closing ']'.
+	 * At worst case ~18 VLANs fit; typical configs with short names fit many more. */
 	__xdata uint16_t i;
 	__xdata uint16_t n;
 	uint8_t first = 1;
@@ -854,9 +855,12 @@ void send_vlanlist(void)
 	for (i = 1; i < 4095; i++) {
 		if (vlan_get(i) < 0)
 			continue;
-		if (!(sfr_data[0] & 0x02))
+		if (!(sfr_data[0] & 0x02)) /* bit 1: VLAN table entry valid */
 			continue;
 
+		if (slen + 139 > TCP_OUTBUF_SIZE) /* 138 bytes worst-case entry + 1 byte for closing ']' */
+			break;
+
 		if (!first)
 			char_to_html(',');
 		first = 0;
@@ -873,8 +877,6 @@ void send_vlanlist(void)
 
 		slen += strtox(outbuf + slen, "\"}");
 
-		if (slen > TCP_OUTBUF_SIZE - 60)
-			break;
 	}
 
 	char_to_html(']');