feat(factory): add local flashing toolkit and secure OTA defaults

tools/esptool-factory/keys/README.md

@@ -0,0 +1,15 @@
+Factory and build-time keys (local-only flow)
+
+This toolkit uses local keys only.
+
+Current usage:
+
+- `factory_signing/factory_signing_key.pem`
+  Used to sign packaged artifacts (`.bin`, config files).
+- `factory_signing/factory_signing_pubkey.pem`
+  Public key used by the flashing tool for signature verification.
+- `firmware/fw_key.bin`
+  32-byte firmware envelope key used for `.bin.enc` encrypt/decrypt.
+  It is copied into release package as `keys/firmware/fw_key.bin`.
+
+Only the key files listed above are required in this repository.