feat: Flex CWX type-ahead backspace (cwx erase) — phase 2

Completes the CWX type-ahead loop: with send-on-type the keyer-panel CW text
already streams each typed char to the radio's CWX buffer (which keys in order,
so you can keep typing while it sends); this adds the matching un-send. Route
wkBackspace to FlexBackspaceCW -> cwx erase N, so backspacing a mistyped char in
send-on-type removes it from the buffer before the radio keys it.

internal/cat/cat.go

@@ -396,9 +396,12 @@ type FlexController interface {
 	SetCWBreakInDelay(int) error
 	// CWX keyer — buffered CW keying via SmartSDR's CWX subsystem, so a Flex needs
 	// no WinKeyer / SmartCAT. SendCW queues text (the radio buffers and keys it);
-	// StopCW clears the buffer, aborting the send.
+	// StopCW clears the buffer, aborting the send. BackspaceCW removes the last n
+	// not-yet-keyed characters from the buffer (un-send while sending — for
+	// type-ahead corrections).
 	SendCW(string) error
 	StopCW() error
+	BackspaceCW(int) error
 	SetCWSidetone(bool) error
 	SetSidetoneLevel(int) error
 	SetCWFilter(int) error