feat(factory): add local flashing toolkit and secure OTA defaults

tools/esptool-factory/README.md

@@ -0,0 +1,79 @@
+# Factory Flashing Toolkit (Local-Only)
+
+This toolkit now runs in local-only mode.
+
+- Network workflows are not used.
+- `flash.bin_encryption` config item is no longer supported.
+- Firmware package format is **always** `.bin.enc` + `.sig`.
+
+## Quick Start
+
+### 1) Build firmware
+
+From project root:
+
+```bash
+idf.py build
+```
+
+The packaging script auto-syncs required plaintext build outputs from `build/flasher_args.json`
+into `tools/esptool-factory/bin/`, then encrypts them into `.bin.enc` for distribution.
+
+### 2) Prepare private config
+
+Use plaintext config:
+
+- `tools/esptool-factory/conf/factory_private.json`
+
+Requirements:
+
+- Do not set `flash.bin_encryption`.
+- Keep `flash.layout` / `app_bin_name` aligned with current build outputs.
+- `flash.app_bin_name` must exist in `flash.layout`, and `flash.app_partition_offset`
+  must match that layout entry offset.
+- `flash.flash_args` (`flash_mode`/`flash_freq`/`flash_size`/`before`/`after`)
+  must use supported enum values.
+- `flash.layout` uses original build artifact names (for example `bootloader.bin`);
+  the packager converts them to `bootloader.bin.enc` automatically.
+
+### 3) Package
+
+From project root:
+
+```bash
+tools/esptool-factory/.venv/bin/python3 tools/esptool-factory/package_factory_tools.py
+```
+
+The packager always uses:
+
+- `tools/esptool-factory/keys/firmware/fw_key.bin`
+
+and copies it into the release package under `keys/firmware/fw_key.bin`.
+
+Default output:
+
+- `tools/esptool-factory/dist/factory/`
+
+You can change output folder name:
+
+```bash
+tools/esptool-factory/.venv/bin/python3 tools/esptool-factory/package_factory_tools.py \
+  --package-name line-a
+```
+
+### 4) Factory use
+
+1. Run packaged GUI.
+2. Connect device and click start.
+3. Tool executes: device check -> flash -> post-flash check.
+   - If secure boot is already enabled but flash `0x0` header is blank/invalid,
+     GUI will switch to initial full-flash provisioning (with force semantics where needed)
+     instead of app-only.
+   - `force` is gated to `bootloader@0x0` only. Before writing, GUI re-checks
+     bootloader image chip/revision compatibility and blocks plaintext force if
+     flash encryption appears enabled.
+
+No environment variable is required for `.enc` decrypt key.
+The GUI reads `keys/firmware/fw_key.bin` from the package directory.
+
+No network endpoint is required.