feat(ota): add authenticated firmware update workflow

- report firmware versions at startup and every six hours with a fresh device JWT
- support optional HMAC headers and retry once after authorization rejection
- handle forced and confirmed updates through managed OTA state
- stream images to the inactive partition and verify size, SHA-256, and format
- coordinate OTA HTTPS activity with voice teardown and restoration
- confirm pending images and expose configuration, status, and integration docs

sdkconfig.defaults

@@ -1,6 +1,7 @@
 CONFIG_ESPTOOLPY_FLASHSIZE_16MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="16MB"
 CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y
+CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y
 
 # Mini-program BLE provisioning.
 CONFIG_BT_ENABLED=y
@@ -85,6 +86,17 @@ CONFIG_TQ_PTT_MODE_CLICK_TO_TALK=y
 # CONFIG_TQ_PTT_MODE_HOLD_TO_TALK is not set
 CONFIG_TQ_PTT_CLICK_CAPTURE_TIMEOUT_MS=8000
 CONFIG_TQ_LOCAL_WAKE_ENABLE=y
+CONFIG_TQ_OTA_ENABLE=y
+CONFIG_TQ_OTA_REPORT_URL="https://gz.api.talkingq.com/ota/api/ota/versionInfoReport"
+CONFIG_TQ_OTA_POLL_INTERVAL_MS=21600000
+CONFIG_TQ_OTA_CONFIRMATION_POLL_MS=21600000
+CONFIG_TQ_OTA_HTTP_TIMEOUT_MS=15000
+CONFIG_TQ_OTA_INSTALL_TIMEOUT_MS=600000
+CONFIG_TQ_OTA_RETRY_BASE_MS=21600000
+CONFIG_TQ_OTA_RETRY_MAX_MS=21600000
+CONFIG_TQ_OTA_TASK_STACK_BYTES=16384
+CONFIG_TQ_OTA_MIN_FREE_INTERNAL_BYTES=32768
+CONFIG_TQ_OTA_MIN_LARGEST_DMA_BYTES=4096
 CONFIG_TQ_LOCAL_WAKE_RESPONSE_PROMPT_ENABLE=y
 CONFIG_TQ_LOCAL_WAKE_RESPONSE_PROMPT_FILE="local_wake_response.opus"
 CONFIG_TQ_LOCAL_WAKE_RETRY_MS=5000