Keep ESP32 OTA reachable whatever the firmware does

- Rollback: override verifyRollbackLater() so a new OTA image stays
  pending until it ran 60 s with WiFi; any earlier restart rolls back
  (the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
  safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/logic/boot_policy.cpp

@@ -0,0 +1,37 @@
+#include "logic/boot_policy.h"
+
+#include "config.h"
+
+BootDecision decideBoot(ResetKind reset, uint8_t crash_count)
+{
+	switch (reset)
+	{
+	case ResetKind::PowerOn:
+		return {BootMode::Normal, 0};
+	case ResetKind::Crash:
+		if (crash_count < 255)
+			crash_count++;
+		if (crash_count >= SAFE_MODE_CRASHES)
+			return {BootMode::SafeMode, crash_count};
+		return {BootMode::PanicWindow, crash_count};
+	case ResetKind::Software:
+	case ResetKind::Other:
+	default:
+		return {BootMode::Normal, crash_count};
+	}
+}
+
+uint8_t crashCountAfterSafeMode()
+{
+	return SAFE_MODE_CRASHES - 1;
+}
+
+bool shouldMarkFirmwareValid(uint32_t running_ms, bool wifi_connected)
+{
+	return running_ms >= FIRMWARE_VALID_TIME && wifi_connected;
+}
+
+bool shouldClearCrashCount(uint32_t running_ms)
+{
+	return running_ms >= CRASH_FREE_TIME;
+}