t23: route sensor fps through tuning ioctl

[matteius]

Summary

• expose the T23 sensor-fps command through the recovered extended tuning router
• route the tuning device's extended and scalar ioctls to the recovered handlers instead of returning a false success
• preserve the requested packed numerator/denominator for GET and module diagnostics

Validation

Built against the exact Thingino T23 Pike 3.10.14 kernel/toolchain. The module reports:

3.10.14__isvp_pike_1.0__ preempt mod_unload MIPS32_R1 32BIT

On cinnado_d1_t23n_sc2336_atbm6012bx, OpenIMP's 16-byte T23 tuning envelope changed the live sensor from 25/1 to 15/1 (983041, packed 0x000f0001). A concurrent LightNVR test then delivered 891 1080p H.264 packets over 59.933 seconds (14.85 fps), with every video delta between 60 and 73 ms and no cadence outliers.