Keep ESP32 OTA reachable whatever the firmware does

- Rollback: override verifyRollbackLater() so a new OTA image stays
  pending until it ran 60 s with WiFi; any earlier restart rolls back
  (the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
  safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -170,9 +170,10 @@ The ESP32 talks to the Nano on **UART2** (`Serial2`, 115200 baud). The ESP32's o
 
 ## How it works
 
-1. **ESP32 boot.** The ESP32 connects to WiFi and starts ArduinoOTA. After a crash or
-   unexpected reset it stays in an *OTA panic window* for 15 seconds, so you can flash a
-   fix before the main code runs again. It then switches the display relay on, waits for
+1. **ESP32 boot.** The ESP32 connects to WiFi and starts ArduinoOTA. After a crash it
+   runs only OTA for 15 seconds, and after repeated crashes it goes to safe mode. Bad OTA
+   firmware is rolled back automatically, see
+   [Keeping OTA alive](src/esp32/README.md#keeping-ota-alive). It then switches the display relay on, waits for
    the Nano's `READY` message (at most 3 s), shows "Connecting...", starts NTP and
    connects to MQTT.
 2. **Clock.** Once the time is synced, the ESP32 sends a new frame whenever the screen