Make controller input best-effort and harden OTA rollback.

Accel/tap use fire-and-forget ESP-NOW with a 10 ms FreeRTOS-safe cadence, OTA recovers from seq gaps and auto-reboots after success, and bootloader app rollback confirms after a stable boot.

Co-authored-by: Cursor <cursoragent@cursor.com>

goTool/ota_upload.go

@@ -21,7 +21,7 @@ const (
 	otaDistQueryTimeout    = 2 * time.Second
 	otaDistEmitMinInterval = 150 * time.Millisecond
 	// Pace host chunks so the master UART RX ring is not overrun (~20 frames/block).
-	otaHostChunkPaceUART = 3 * time.Millisecond
+	otaHostChunkPaceUART = 5 * time.Millisecond
 	// Slightly slower for BLE WriteWithoutResponse flow control.
 	otaHostChunkPaceBLE = 6 * time.Millisecond
 	otaBlockMaxRetries  = 3
@@ -389,7 +389,7 @@ func runOTAUnlocked(t otaTransport, firmware []byte, onProgress otaProgressFn) e
 		mergeSlaveProgressResponse(prog, slaveBytes, slaveDetails)
 	}
 	notify("done", "", 100,
-		fmt.Sprintf("Fertig — %d bytes, Boot-Slot %d. Master und Slaves neu starten.",
+		fmt.Sprintf("Fertig — %d bytes, Boot-Slot %d. Geräte starten neu auf die neue Firmware.",
 			st.GetBytesWritten(), st.GetTargetSlot()),
 		OTAProgress{
 			Bytes: st.GetBytesWritten(), Slot: st.GetTargetSlot(),