feat: widen ADDR_WIDTH to 23 bits for full 8MB PSRAM addressing

Bumps ADDR_WIDTH's default from 22 to 23 bits across every RTL
module (neuron_memory, layer_sequencer, spi_engine, spi_neuron_top,
mem_arbiter, int8_memory_access, memory_interface, psram_controller,
memory_model) and every testbench that mirrors it, so the system's
byte-address space reaches the full 8 MiB the recommended PSRAM part
(ISSI IS66WVE4M16EBLL-70BLI, docs/FPGA-Neural-Hardware-Design.md §3)
actually provides -- previously only 4 MiB (half the chip) was
reachable, since int8_memory_access.v's byte->word address shift
(addr >> 1) turned the old 22-bit byte address into only 21 real word
bits, one short of the chip's real 22-bit word address (A0-A21). At
23 bits, that same shift lands exactly on all 22 chip address lines,
so the whole part is usable now instead of deferred to a future
widening.

Also fixes a stray 22'd11-sized literal in layer_sequencer.v's
descriptor-table address increment (numerically already safe via
Verilog's zero-extension, but now correctly unsized so it always
matches ADDR_WIDTH instead of silently assuming 22).

Updated docs/FPGA-NeuralNetwork-Engine.md's SPI protocol address-field
note (23 bits, top 1 reserved bit instead of 2) and
docs/FPGA-Neural-Hardware-Design.md's PSRAM section (the "chip has
one spare address line" framing is gone now that all 22 are wired
and used).

Full regression (all 11 ADDR_WIDTH-touching testbenches, plus a
Yosys elaboration check of spi_neuron_top with the new default and
no override) passes clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WQV3vS9TXaGDJ5cRfnfidt

docs/FPGA-Neural-Hardware-Design.md

@@ -89,15 +89,17 @@ not** plug into this controller without a rewrite.
   RTL change needed.
 - TSOP-44/48 package — hand-solderable-adjacent, real distributor
   listings (DigiKey, Mouser) at time of writing.
-- **Address bus note:** the chip is 4M×16 words (8 MB total,
-  needs a real 22-bit word address, A0–A21). The current RTL's
-  `ADDR_WIDTH=22` is a **byte** address (4 MiB space) that
-  `int8_memory_access.v` right-shifts by 1 (`addr >> 1`) into a word
-  address before it reaches `psram_controller` — so only **21**
-  word-address bits are actually driven today. Wire all 22 chip
-  address balls, but the chip's topmost line (A21) stays unused/tied
-  low until `ADDR_WIDTH` is widened to 23 to use the chip's full
-  8 MB instead of today's 4 MiB. Free headroom, not a defect.
+- **Address bus (2026-09-02: full addressing, all 22 chip lines
+  wired):** the chip is 4M×16 words (8 MB total), needing a
+  real 22-bit word address, A0–A21. `ADDR_WIDTH` is now **23**
+  bits across every module (`rtl/neuron_memory.v`,
+  `rtl/psram_controller.v`, etc. — bumped from the earlier 22-bit/
+  4 MiB default specifically to reach the full chip).
+  `int8_memory_access.v` right-shifts the 23-bit **byte** address by
+  1 (`addr >> 1`) into a 22-bit **word** address before it reaches
+  `psram_controller` — that 22-bit word address maps exactly onto
+  the chip's real A0–A21, with nothing left unconnected. Full
+  8 MB is addressable today, not deferred.
 
 **Fallback: ISSI IS61WV6416DBLL / IS61WV102416BLL** (true async
 SRAM, not pseudo-SRAM) — electrically drop-in on the same
@@ -214,7 +216,7 @@ Before schematic capture, someone needs to:
 
 | Signal group | Port(s) | Count | Target bank (TBD) |
 |---|---|---|---|
-| PSRAM address | `psram_a[21:0]` | 22 | one bank |
+| PSRAM address | `psram_a[21:0]` (port is `[22:0]`, bit 22 always 0 post-shift — see §3) | 22 | one bank |
 | PSRAM data | `psram_dq[15:0]` | 16 | same or adjacent bank |
 | PSRAM control | `psram_ce_n/oe_n/we_n/lb_n/ub_n/zz_n` | 6 | same bank as above |
 | Application SPI | `sclk/mosi/miso/cs_n` | 4 | any bank, NOT the config-SPI bank (§6) |
@@ -244,9 +246,12 @@ sizes are decided.
 
 ## 9. Open items before schematic capture
 
-- [ ] Decide real PSRAM density needed (drives whether `ADDR_WIDTH`
-      stays 22 or can shrink, and whether the fallback true-SRAM
-      part in §3 is sufficient instead of the pseudo-SRAM)
+- [x] `ADDR_WIDTH` set to 23 (full 8 MB) across all RTL modules
+      and testbenches, matching the recommended part's real capacity
+      (2026-09-02) — see §3.
+- [ ] If the fallback true-SRAM part in §3 is used instead (smaller
+      density), decide whether to shrink `ADDR_WIDTH` back down to
+      match it or keep 23 with the extra range simply unused.
 - [ ] Real `.lpf` pin assignment (§7) and a synthesis run against it
       (current benchmark results all use auto-placed I/O)
 - [ ] Confirm PSRAM/SPI signal integrity at whatever clock is

docs/FPGA-NeuralNetwork-Engine.md

@@ -400,9 +400,10 @@ here). The FPGA is always SPI slave. One command per CS-low period;
 byte 0 of every transaction is the opcode.
 
 **Multi-byte fields** are big-endian (most significant byte first).
-Byte addresses are `ADDR_WIDTH`-bit (22 bits today, from
-`rtl/neuron_memory.v`), carried in a 3-byte field with the top 2 bits
-reserved as 0.
+Byte addresses are `ADDR_WIDTH`-bit (23 bits today, from
+`rtl/neuron_memory.v` — sized for a full 8 MiB PSRAM, see
+`docs/FPGA-Neural-Hardware-Design.md` §3), carried in a 3-byte field
+with the top bit reserved as 0.
 
 **Length is explicit**, not CS-edge-delimited: `WRITE_RAM`/`READ_RAM`
 carry a 2-byte length field, so the SPI controller only needs a byte