feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/control_plane/src/multimodal/control_plane_multimodal_local_wake.c

@@ -390,6 +390,9 @@ esp_err_t control_plane_local_wake_start(void)
 #if !CONFIG_TQ_LOCAL_WAKE_ENABLE
     return ESP_OK;
 #else
+    if (!control_plane_ota_voice_services_allowed()) {
+        return ESP_ERR_INVALID_STATE;
+    }
     portENTER_CRITICAL(&s_local_wake_lock);
     if (s_local_wake.task != NULL || s_local_wake.started) {
         portEXIT_CRITICAL(&s_local_wake_lock);