feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/domain/src/runtime/domain_runtime_adapters.c

@@ -859,6 +859,11 @@ void domain_runtime_read_device_identity(char *device_id,
     platform_read_device_identity(device_id, device_id_len, serial_number, serial_number_len);
 }
 
+esp_err_t domain_runtime_read_firmware_version(char *out, size_t out_len)
+{
+    return platform_read_firmware_version(out, out_len);
+}
+
 esp_err_t domain_runtime_write_device_identity(const char *device_id, const char *serial_number)
 {
     return platform_write_device_identity(device_id, serial_number);