Keep ESP32 OTA reachable whatever the firmware does

- Rollback: override verifyRollbackLater() so a new OTA image stays
  pending until it ran 60 s with WiFi; any earlier restart rolls back
  (the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
  safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/net/home_assistant.h

@@ -2,8 +2,12 @@
 
 #include "logic/display_controller.h"
 
-// Home Assistant integration over MQTT (with discovery). Two switches:
-//   FlipDot Display Clock  on = clock, off = Nintendo logo
-//   FlipDot Display Power  off = clear the display and switch it off
+// Home Assistant integration over MQTT (with discovery):
+//   FlipDot Display Clock     switch: on = clock, off = Nintendo logo
+//   FlipDot Display Power     switch: off = clear the display and switch it off
+//   FlipDot Display Firmware  sensor: version and health, e.g. "2.1.0, ok, 0 crashes"
 void homeAssistantBegin(DisplayController &controller);
 void homeAssistantLoop();
+
+// Publish the firmware status (only sent when it changes, and again after a reconnect)
+void homeAssistantSetFirmwareStatus(const char *status);