feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

main/Kconfig.projbuild

@@ -43,6 +43,80 @@ menu "Example Configuration"
                 firmware uses a longer timeout to tolerate brief beacon loss on
                 crowded 2.4 GHz networks.
 
+    menu "OTA Firmware Update"
+
+        config TQ_OTA_ENABLE
+            bool "Enable managed OTA firmware updates"
+            default y
+            depends on AUTH_V2_ENABLE
+            select BOOTLOADER_APP_ROLLBACK_ENABLE
+
+        config TQ_OTA_REPORT_URL
+            string "OTA version report URL"
+            default "https://gz.api.talkingq.com/ota/api/ota/versionInfoReport"
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_INTERNAL_AUTH_SECRET
+            string "OTA internal-auth compatibility secret"
+            default ""
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_POLL_INTERVAL_MS
+            int "Normal OTA poll interval (ms)"
+            default 21600000
+            range 10000 86400000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_CONFIRMATION_POLL_MS
+            int "OTA confirmation recheck interval (ms)"
+            default 21600000
+            range 2000 86400000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_HTTP_TIMEOUT_MS
+            int "OTA report HTTP timeout (ms)"
+            default 15000
+            range 1000 60000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_INSTALL_TIMEOUT_MS
+            int "OTA download/install deadline (ms)"
+            default 600000
+            range 30000 1800000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_RETRY_BASE_MS
+            int "OTA retry backoff base (ms)"
+            default 21600000
+            range 1000 86400000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_RETRY_MAX_MS
+            int "OTA retry backoff cap (ms)"
+            default 21600000
+            range 10000 86400000
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_TASK_STACK_BYTES
+            int "OTA worker stack (bytes)"
+            default 16384
+            range 8192 32768
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_MIN_FREE_INTERNAL_BYTES
+            int "OTA HTTPS minimum free internal memory (bytes)"
+            default 32768
+            range 16384 131072
+            depends on TQ_OTA_ENABLE
+
+        config TQ_OTA_MIN_LARGEST_DMA_BYTES
+            int "OTA HTTPS minimum largest DMA block (bytes)"
+            default 4096
+            range 2048 32768
+            depends on TQ_OTA_ENABLE
+
+    endmenu
+
     endmenu
 
     menu "Mini Program Wi-Fi Provisioning"