OTA: the firmware rolls itself back; the bootloader doesn't

A deliberately crashing update looped forever on the device: the
prebuilt bootloader ignores ESP_OTA_IMG_PENDING_VERIFY despite the
app-side rollback config. UpdateService::bootGuard() now runs first in
setup(): it counts starts on Probation in NVS and, on the second
unconfirmed start, marks the image invalid and reboots into the
previous one. Confirming (or the Wi-Fi rollback) resets the counter.
ADR 0003 records the limit: a crash in the first milliseconds still
needs USB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/services/update_service.h

@@ -20,6 +20,9 @@ class UpdateService : public Service {
     enum class Phase { Idle, Receiving, Installed, Failed };
     static constexpr uint16_t kPort = 3232;
 
+    // Call first in setup(): rolls back new firmware that already died once on Probation.
+    static void bootGuard(KeyValueStore& store);
+
     UpdateService(KeyValueStore& store, WifiService& wifi, SavedNetworks& saved, StorageService& storage,
                   EventBus& bus, const Settings& settings);
     const char* name() const override { return "update"; }