Keep ESP32 OTA reachable whatever the firmware does

- Rollback: override verifyRollbackLater() so a new OTA image stays
  pending until it ran 60 s with WiFi; any earlier restart rolls back
  (the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
  safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -91,6 +91,21 @@ See README.md for the overview.
   The unique ids `FlipDotDisplayClock` / `FlipDotDisplayPower` and `HA_DEVICE_ID` must stay
   the same, or Home Assistant creates new entities.
 
+## Keeping ESP32 OTA alive (most important requirement)
+
+- The user never wants to need USB for the ESP32 again. Any change must keep OTA working,
+  also when the new code crashes or hangs.
+- `system/firmware_guard.cpp` overrides the Arduino core's weak `verifyRollbackLater()`
+  (C linkage) to return true. A new OTA image stays `PENDING_VERIFY` until it has run
+  `FIRMWARE_VALID_TIME` with WiFi. Any restart before that makes the bootloader roll back.
+  Check with `nm` that the strong symbol is linked after toolchain or core updates.
+- The task watchdog (`WATCHDOG_TIMEOUT_S`) covers `loop()`. ArduinoOTA's `onStart` stops
+  it, because an upload blocks `loop()`. Never block `loop()` for 30 s or longer.
+- The crash counter lives in `RTC_NOINIT_ATTR` memory. Decisions are in
+  `logic/boot_policy.*` (tested). Safe mode runs only WiFi + OTA.
+- Keep `otaLoop()` and `firmwareGuardLoop()` at the top of `loop()`, before anything that
+  can return early or block.
+
 ## Git
 
 - Remote: https://mangavalk.com/mangavalk/Flipdot-display.git, branch `main`.