feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/platform/CMakeLists.txt

@@ -3,6 +3,7 @@ set(platform_srcs
         "src/runtime/platform_storage.c"
         "src/runtime/platform_time.c"
         "src/runtime/platform_https_client.c"
+        "src/runtime/platform_ota.c"
         "src/runtime/platform_lan_http_server.c"
         "src/runtime/platform_ble_gatt_server.c"
         "src/platform_console_driver.c"
@@ -37,11 +38,13 @@ set(platform_priv_requires
         esp_driver_spi
         esp_event
         esp_app_format
+        app_update
         esp_http_client
         esp_http_server
         esp_lcd
         esp_netif
         esp_psram
+        heap
         esp_system
         esp_timer
         esp_wifi