Make controller input best-effort and harden OTA rollback.

Accel/tap use fire-and-forget ESP-NOW with a 10 ms FreeRTOS-safe cadence, OTA recovers from seq gaps and auto-reboots after success, and bootloader app rollback confirms after a stable boot.

Co-authored-by: Cursor <cursoragent@cursor.com>

main/powerpod.c

@@ -14,6 +14,7 @@
 #include "cmd_version.h"
 #include "cmd_ota.h"
 #include "cmd_ota_slave_progress.h"
+#include "ota_confirm.h"
 #include "cmd_led_ring.h"
 #include "cmd_battery.h"
 #include "cmd_set_log_level.h"
@@ -236,6 +237,10 @@ void app_main(void) {
   }
 
   ESP_LOGI(TAG, "LED ring: UART LED_RING commands only (no local demo loop)");
+
+  /* After OTA: PENDING_VERIFY until confirm; crash before this → rollback. */
+  ota_confirm_schedule();
+
   while (1) {
     vTaskDelay(portMAX_DELAY);
   }