OTA step 2: signing key, Update File builder, push client

- scripts/ota_keygen.sh: ECDSA P-256 key pair; the private key goes to
  ~/.config/roro9stack/ (0600), the public key to keys/ and
  src/platform/ota_public_key.h; .gitignore refuses *key.pem
- scripts/make_ota.py: wraps firmware.bin into a signed .ota (openssl)
- scripts/ota_push.py: sends it over TCP 3232, prints the device's answer
- scripts/flash.sh --ota <host>: build, sign, push

Checked: a generated .ota has the documented layout and its signature
verifies with openssl against the committed public key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

scripts/ota_push.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Pushes a signed Update File to a Cardputer over Wi-Fi (TCP 3232) and reports the result.
+
+Usage: scripts/ota_push.py <file.ota> <host>
+<host> is the device's IP (shown in Settings > About), or its name when mDNS works on your network.
+"""
+import socket
+import sys
+
+PORT = 3232
+
+
+def main():
+    if len(sys.argv) < 3:
+        sys.exit(__doc__)
+    path, host = sys.argv[1:3]
+    data = open(path, "rb").read()
+    with socket.create_connection((host, PORT), timeout=15) as s:
+        s.settimeout(60)
+        sent = 0
+        while sent < len(data):
+            chunk = data[sent:sent + 4096]
+            s.sendall(chunk)
+            sent += len(chunk)
+            print(f"\rsending {sent * 100 // len(data):3d}%", end="", flush=True)
+        s.shutdown(socket.SHUT_WR)  # end of file: the device checks it and answers
+        reply = b""
+        while not reply.endswith(b"\n"):
+            part = s.recv(256)
+            if not part:
+                break
+            reply += part
+    print()
+    reply = reply.decode(errors="replace").strip()
+    print(f"device: {reply or '(no answer)'}")
+    sys.exit(0 if reply.startswith("OK") else 1)
+
+
+if __name__ == "__main__":
+    main()