Clear the 28 compiler warnings, then gate on them

[ramereth]

--warnings all produces 28 warnings on the stock build. CI reports the
count but does not gate on it, because a gate everybody ignores is worse than no
gate.

Goal: drive the count to zero, then flip the CI warnings report to blocking so
it stays there.

Known categories:

• unused variables (char ch in magic(), uint32_t passwd, password in
  menu(), the shadowed int16_t ch16)
• sprintf into a uint8_t* where char* is expected (works, but only because
  the Arduino build passes -fpermissive)
• signed/unsigned comparisons

Good first-issue material, and it should be flash-neutral or slightly positive.
Best done as several small PRs rather than one sweep, so the size delta of each
is legible.