feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

components/platform/include/platform.h

@@ -137,6 +137,11 @@ typedef struct {
     int status_code;
 } platform_https_response_t;
 
+typedef void (*platform_ota_progress_callback_t)(uint64_t bytes_received,
+                                                 uint64_t total_bytes,
+                                                 void *user_data);
+typedef bool (*platform_ota_cancel_callback_t)(void *user_data);
+
 #define PLATFORM_BLE_UUID128_LEN          16
 #define PLATFORM_BLE_GATT_NAME_MAX_LEN    31
 #define PLATFORM_BLE_GATT_VALUE_MAX_LEN   512
@@ -252,6 +257,19 @@ bool platform_time_is_synced(void);
  */
 esp_err_t platform_https_post_json(const platform_https_post_json_request_t *request,
                                    platform_https_response_t *response);
+
+esp_err_t platform_ota_install_image(const char *url,
+                                     const uint8_t expected_sha256[32],
+                                     uint64_t expected_size,
+                                     int timeout_ms,
+                                     platform_ota_progress_callback_t progress_cb,
+                                     platform_ota_cancel_callback_t cancel_cb,
+                                     void *user_data);
+esp_err_t platform_ota_confirm_running_image(void);
+esp_err_t platform_ota_get_memory_headroom(uint32_t *free_internal,
+                                           uint32_t *largest_internal,
+                                           uint32_t *largest_dma);
+void platform_restart(void);
 bool platform_https_is_connect_error(esp_err_t err);
 
 /** Start a generic single-service BLE GATT peripheral. */