Make controller input best-effort and harden OTA rollback.

Accel/tap use fire-and-forget ESP-NOW with a 10 ms FreeRTOS-safe cadence, OTA recovers from seq gaps and auto-reboots after success, and bootloader app rollback confirms after a stable boot.

Co-authored-by: Cursor <cursoragent@cursor.com>

main/cmd/cmd_ota.c

@@ -2,6 +2,7 @@
 #include "led_ring.h"
 #include "ota_espnow.h"
 #include "ota_uart.h"
+#include "pod_reboot.h"
 #include "uart_cmd.h"
 #include "esp_log.h"
 #include "freertos/FreeRTOS.h"
@@ -179,8 +180,10 @@ static void handle_ota_payload(const uint8_t *data, size_t len) {
 
   ota_feed_result_t r = ota_uart_feed_chunk(req_ptr->seq, req_ptr->data.bytes,
                                             req_ptr->data.size);
+  /* Gap: keep session; host block-retries from the last ACK boundary. */
   if (r == OTA_FEED_SEQ_GAP) {
-    send_ota_failed(16);
+    ESP_LOGW(TAG, "OTA_PAYLOAD seq gap (got %lu) — waiting for host retry",
+             (unsigned long)req_ptr->seq);
     return;
   }
   if (r == OTA_FEED_SEQ_DUP) {
@@ -257,6 +260,8 @@ static void ota_distribute_task(void *param) {
 
   led_ring_ota_success();
   free(job);
+  /* Host already got SUCCESS; reboot onto the staged image. */
+  pod_schedule_restart();
   vTaskDelete(NULL);
 }
 
@@ -332,6 +337,7 @@ static void ota_start_espnow_task(void *param) {
   response.payload.ota_status.error = 0;
   uart_cmd_send(&response, TAG);
   led_ring_ota_success();
+  pod_schedule_restart();
   vTaskDelete(NULL);
 }