ESP32 nodes poll GET /api/v1/firmware/latest and self-upgrade when the
server advertises a newer version. SHA-256 verified; ESP-IDF rollback
failsafe reverts on crash in the first boot window.
Server side: new firmware_registry module (in-memory manifest holder,
set_current, is_update_available, sha256_bytes/sha256_file helpers,
11 unit tests). Three HTTP endpoints wired into sensing-server:
GET /api/v1/firmware/latest
GET /api/v1/firmware/download
POST /api/v1/firmware/upload?version=X[&sha256=HEX]
Startup scan of --firmware-dir seeds the registry from the newest .bin.
Firmware client (ota_pull.c, +413 LOC): polling task, SHA-256 verify,
OTA partition write, BLE stop guard, uptime guard, graceful retry on error.
Includes ADR-094 design record and CHANGELOG entry.
7a8b72de76