Make controller input best-effort and harden OTA rollback.

Accel/tap use fire-and-forget ESP-NOW with a 10 ms FreeRTOS-safe cadence, OTA recovers from seq gaps and auto-reboots after success, and bootloader app rollback confirms after a stable boot.

Co-authored-by: Cursor <cursoragent@cursor.com>

main/ota_confirm.h

@@ -0,0 +1,14 @@
+#ifndef OTA_CONFIRM_H
+#define OTA_CONFIRM_H
+
+/**
+ * After OTA with BOOTLOADER_APP_ROLLBACK_ENABLE, the new image boots as
+ * ESP_OTA_IMG_PENDING_VERIFY. If we crash/reset before confirming, the
+ * bootloader rolls back to the previous app on the next boot.
+ *
+ * Call once from app_main after init: schedules a delayed confirm so early
+ * panics (task asserts, etc.) still trigger rollback.
+ */
+void ota_confirm_schedule(void);
+
+#endif