fix(w5100): unlock NETLCKR before writing GWR/SUBR/SHAR/SIPR (W5100S)

Second W5100S-vs-W5100 gotcha found at bring-up: the W5100S has a Network Lock
Register (NETLCKR, 0x0071) the original W5100 lacks. It defaults to 0x00 (locked),
and while locked, ALL writes to GWR/SUBR/SHAR/SIPR are silently dropped -- so the
chip has no source IP/MAC and the UDP/MACRAW send builds nothing (chip reports
SEND_OK but transmits nothing; socket registers aren't locked, which is why an
indirect write/readback of Sn_PORT succeeded). Fix: write the unlock value 0x3A
to NETLCKR right after MR enables indirect mode, before the network-config writes.
On the bench this flipped the board from silent to actually keying frames onto
the wire (magjack activity LED now blinks).

Also:
- bba_top.py test model: RX buffer base 0x6000 -> 0xC000 to match the W5100S
  buffer-base fix (the model hardcoded the old W5100 address).
- w5100_selftest.py: added an indirect-mode (IDM) write/readback probe of a
  socket register + IND= field in the UART report, to isolate direct-vs-indirect
  access (confirmed indirect works on the real chip).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

exi_bba/bba_top.py

@@ -457,7 +457,7 @@ if __name__ == "__main__":
     # Pre-loads a known MACRAW packet in the RX buffer so we can verify the full
     # ethernet→SPRAM→GC path.  Same protocol as the W5100ParallelMaster bench.
     RX_FRAME = [0xDE, 0xAD, 0xBE, 0xEF, 0x01, 0x02, 0x03, 0x04]
-    _W_RX_BASE   = 0x6000
+    _W_RX_BASE   = 0xC000   # W5100S RX memory base (was 0x6000 on the W5100)
     _W_S0_CR     = 0x0401
     _W_S0_RX_RSR = 0x0426
     _W_S0_RX_RD  = 0x0428