firmware: OTA firmware updates via POST /firmware + rollback

Streams the raw .bin to the inactive ota_0/ota_1 slot via esp_ota_*, flips otadata, replies 200, reboots after 500 ms. Single-shot guarded by atomic_flag (409 on concurrent). CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE armed: new images boot pending-verify and ota_arm_healthy_timer marks them valid after 30 s of healthy uptime; otherwise the bootloader reverts on next reset. /state gains ota_state.

1 files changed, 6 insertions, 0 deletions

diff --git a/main/app_main.c b/main/app_main.c
index a6174c8..fa63e26 100644
--- a/main/app_main.c
+++ b/main/app_main.c
@@ -5,6 +5,7 @@
 #include "mdns_service.h"
 #include "net_eth.h"
 #include "nvs_config.h"
+#include "ota.h"
 #include "state_client.h"
 #include "state_machine.h"
 #include "stream_server.h"
@@ -77,6 +78,11 @@ void app_main(void)
     // the snapshot one-shot and for curl debugging.
     mark(stream_server_start(81), 'S', &flags[3]);
 
+    // If this image is still PENDING_VERIFY from a fresh OTA, mark it
+    // valid after 30 s of healthy uptime so the bootloader stops
+    // considering it revertible. No-op once already marked valid.
+    ota_arm_healthy_timer();
+
     // ------------------------------------------------------------------
     // Display + I²C-bound peripherals run on their own task. ESP-IDF's
     // esp_lcd_new_dsi_bus() spins forever in a PHY-PLL busy-wait if the