feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/control_plane/include/control_plane.h

@@ -60,6 +60,32 @@ typedef struct {
     const char *parameters_json;
 } control_plane_multimodal_update_info_request_t;
 
+typedef enum {
+    CONTROL_PLANE_OTA_STATE_DISABLED = 0,
+    CONTROL_PLANE_OTA_STATE_IDLE,
+    CONTROL_PLANE_OTA_STATE_WAITING_FOR_NETWORK,
+    CONTROL_PLANE_OTA_STATE_WAITING_FOR_RESOURCES,
+    CONTROL_PLANE_OTA_STATE_CHECKING,
+    CONTROL_PLANE_OTA_STATE_WAITING_FOR_CONFIRMATION,
+    CONTROL_PLANE_OTA_STATE_DOWNLOADING,
+    CONTROL_PLANE_OTA_STATE_READY_TO_REBOOT,
+    CONTROL_PLANE_OTA_STATE_ERROR,
+    CONTROL_PLANE_OTA_STATE_STOPPED,
+} control_plane_ota_state_t;
+
+typedef struct {
+    control_plane_ota_state_t state;
+    bool running;
+    bool forced;
+    bool confirmed;
+    char target_version[32];
+    uint64_t bytes_received;
+    uint64_t total_bytes;
+    uint32_t consecutive_failures;
+    int last_http_status;
+    esp_err_t last_error;
+} control_plane_ota_snapshot_t;
+
 esp_err_t control_plane_init(void);
 
 /**
@@ -196,6 +222,10 @@ esp_err_t control_plane_multimodal_update_info(
 esp_err_t control_plane_start_runtime_workers(void);
 void control_plane_stop_runtime_workers(void);
 
+esp_err_t control_plane_start_ota_service(void);
+esp_err_t control_plane_stop_ota_service(int timeout_ms);
+esp_err_t control_plane_get_ota_snapshot(control_plane_ota_snapshot_t *out);
+
 /**
  * @brief Start the staged event observer runtime only.
  *