OTA steps 3-5: Update Service, Probation and Rollback, Update from SD

- EcdsaVerifier (mbedTLS, embedded public key) and EspOtaSink (writes
  the inactive app slot, esp_ota_end validates the image, then sets
  the boot partition)
- UpdateService: listens on TCP 3232 (and mDNS roro9stack-<id>) while
  Wi-Fi is Connected; streams into UpdateParser; replies OK/ERR to the
  sender; remembers the pending version so a Rollback is reported
  after the reboot
- Probation (host-tested): confirm after the first frame + 30 s + Wi-Fi
  (if configured); roll back if configured Wi-Fi never connects in 3 min
- Main loop: full-screen progress while receiving; restart once
  installed, waiting up to 60 s for Text Entry to end
- Settings > Firmware: version, Probation status, push address and
  name, and the .ota files in /updates on the SD card to install
- StorageService.runJob() runs work on the storage task (SD installs)
- wifi status prints IP and running version; RORO_TEST_CRASH test hook

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

test/test_ota/test_ota.cpp

@@ -4,6 +4,7 @@
 #include <string>
 #include <vector>
 
+#include "probation.h"
 #include "sha256.h"
 #include "update_parser.h"
 #include "version_compare.h"
@@ -239,6 +240,32 @@ void test_version_comparison() {
     TEST_ASSERT_FALSE(versionOlder("v0.2.1", "4c0be89"));
 }
 
+// ---- probation --------------------------------------------------------------
+
+static int judge(uint32_t up, bool frame, bool configured, bool connected) {
+    return static_cast<int>(Probation::judge(up, frame, configured, connected));
+}
+static const int kWait = static_cast<int>(Probation::Verdict::Wait);
+static const int kConfirm = static_cast<int>(Probation::Verdict::Confirm);
+static const int kRollBack = static_cast<int>(Probation::Verdict::RollBack);
+
+void test_probation_waits_30_seconds_and_a_first_frame() {
+    TEST_ASSERT_EQUAL(kWait, judge(29999, true, false, false));
+    TEST_ASSERT_EQUAL(kWait, judge(60000, false, false, false));
+    TEST_ASSERT_EQUAL(kConfirm, judge(30000, true, false, false));
+}
+
+void test_probation_needs_wifi_when_it_is_configured() {
+    TEST_ASSERT_EQUAL(kWait, judge(60000, true, true, false));
+    TEST_ASSERT_EQUAL(kConfirm, judge(60000, true, true, true));
+}
+
+void test_probation_rolls_back_when_wifi_never_comes() {
+    TEST_ASSERT_EQUAL(kWait, judge(179999, true, true, false));
+    TEST_ASSERT_EQUAL(kRollBack, judge(180000, true, true, false));
+    TEST_ASSERT_EQUAL(kConfirm, judge(500000, true, false, false));  // no Wi-Fi configured: fine
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_sha256_known_vectors);
@@ -255,5 +282,8 @@ int main() {
     RUN_TEST(test_image_larger_than_the_slot_is_refused_before_writing);
     RUN_TEST(test_downgrade_is_flagged_but_allowed);
     RUN_TEST(test_version_comparison);
+    RUN_TEST(test_probation_waits_30_seconds_and_a_first_frame);
+    RUN_TEST(test_probation_needs_wifi_when_it_is_configured);
+    RUN_TEST(test_probation_rolls_back_when_wifi_never_comes);
     return UNITY_END();
 }