Add signed preserving USB application updates

[eirabie]

Summary

Existing speakers need a preserving USB update path separate from full-flash installation. Add read-only firmware information and a signed, bounded transfer into the inactive application slot. Firmware verifies the descriptor, image/hash/version and rollback bootloader while retaining settings, credentials, prayer-consumption history, shared audio and both application slots.

USB and Wi-Fi update ownership are exclusive. Selected USB updates wait for the owner to switch from Atom USB to Pyramid bottom-only power; startup health confirmation and rollback determine the outcome. Failed or contradictory selection reads retain the durable journal and block discard or another update. Interrupted discard rechecks selection before clearing the request, and a newer running version cannot prematurely clear an older, still-selected USB request. Interrupted USB requests never become network downloads.

Authenticated playback Stop remains available throughout USB ownership, including interrupted transfers and uncertain power handoffs. Only exact POST /api/stop requests are exempt from the mutation lock; existing access checks and local API payload validation still apply. Stopping playback preserves the update journal and ownership, settings and prayer history. Other writes remain blocked.

See the protocol and qualification contract and development validation. Companion website PR #12 keeps public USB updates disabled until physical qualification and a capable release.

Hardware impact

• No new required hardware
• Adds optional hardware
• Changes the required reference BOM

The reference AtomS3R C126 + Pyramid A167 and partition layout are unchanged.

Standalone impact

Prayer calculations, scheduling, audio, settings and device controls retain standalone operation. USB needs no internet or valid clock; beginning a transfer requires healthy confirmed services, a compatible rollback bootloader and no active playback. The device-local Updates group displays USB ownership and hides network cancellation while USB owns the update. Owners can still stop later playback from Today or Settings.

Testing

Automated:

• GitHub Actions: all eight checks passed on current head c89804f.
• CMake/CTest: 16 passed; complete required Python suite: 103 passed without skips.
• Eleven production/isolated/qualification updater and HTTP profiles passed with UBSan. The production HTTP handler and Digest verifier regression fails against 39c3d14 with Stop returning 409 after a simulated partial-transfer restart, and passes with the correction across all five USB states. It verifies access checks, other mutation blocking and unchanged journal/OTA/boot-selection state. Real local API tests verify malformed payload rejection, scheduled playback stopping and settings/history preservation.
• Complete Chromium/WebKit device UI suite: 486 passed without skips using locked Playwright 1.62.1 and Node 24.19.0, including 20 new Today/Settings Stop cases across USB ownership states.
• All four matched pinned-toolchain build pairs and capacity checks passed. Final reference OTA: 1,274,176 bytes, +32 bytes for the Stop correction and +8,416 bytes for the complete PR, leaving 298,688 bytes under the 1.5 MiB budget and 822,976 bytes free in the 2 MiB slot. Static RAM is unchanged. Other variants and artifact hashes are recorded in the report.
• Resolved ESP-IDF request/header regressions passed.

Hardware: none accessed or changed. USB transfer, actual preservation/power handoff/rollback, responsiveness and runtime heap/fragmentation remain unqualified for this transport. Synthetic CI recordings were compile fixtures only and were not installed or played.

Licensing/media

• No new third-party media or dependency licensing concerns
• Licensing/attribution details are documented in this PR