feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/domain/CMakeLists.txt

@@ -8,6 +8,7 @@ idf_component_register(
         "src/fortune/domain_fortune_store.c"
         "src/fortune/domain_user_config_server.c"
         "src/runtime/domain_runtime_adapters.c"
+        "src/runtime/domain_ota.c"
         "src/runtime/domain_local_command.c"
         "src/runtime/domain_mini_program_provisioning.c"
     INCLUDE_DIRS
@@ -19,6 +20,7 @@ idf_component_register(
         esp-sr
         log
         json
+        mbedtls
     EMBED_TXTFILES
         "assets/user_config.html"
 )