feat(firmware,sensing-server): pull-based OTA — client + registry

[schwarztim]

Summary

• ESP32 OTA pull client (firmware/esp32-csi-node/main/ota_pull.c, +412 LOC): sensing nodes poll GET /api/v1/firmware/latest every 5 min, download + SHA-256 verify a newer binary via GET /api/v1/firmware/download, write it to the ESP-IDF OTA partition, and restart. Includes BLE stop guard, 5-min uptime gate before first check, and relies on the existing ota_update.c canary task for ESP-IDF rollback.
• Server firmware registry (v2/crates/wifi-densepose-sensing-server/src/firmware_registry.rs, +452 LOC): pure-Rust, transport-agnostic in-memory registry with SHA-256 integrity, sidecar manifest support, version parsing from filename, and 11 unit tests.
• Three HTTP endpoints wired into main.rs: GET /api/v1/firmware/latest, GET /api/v1/firmware/download, POST /api/v1/firmware/upload?version=X.
• ADR-095 (docs/adr/ADR-095-pull-based-ota.md): design record documenting the pull model, architecture, and tradeoffs.
• CHANGELOG updated under [Unreleased].

Motivation

Push-based OTA requires operators to enumerate every node IP. Nodes that come online intermittently or are behind NAT/CGNAT get missed entirely. The pull model has zero operator action for routine upgrades — nodes catch up on their next poll cycle regardless of network topology.

Files changed

Path	Change
firmware/esp32-csi-node/main/ota_pull.c	New — 412-LOC OTA pull task
firmware/esp32-csi-node/main/ota_pull.h	New — header
firmware/esp32-csi-node/main/CMakeLists.txt	Add ota_pull.c to SRCS
firmware/esp32-csi-node/main/main.c	Wire ota_pull_init() on network-up path
v2/crates/wifi-densepose-sensing-server/src/firmware_registry.rs	New — Rust registry + 11 tests
v2/crates/wifi-densepose-sensing-server/src/main.rs	Wire 3 endpoints + AppStateInner fields
v2/crates/wifi-densepose-sensing-server/Cargo.toml	Add sha2, thiserror deps
docs/adr/ADR-095-pull-based-ota.md	New ADR
CHANGELOG.md	Unreleased entry

Test plan

• cargo test --workspace --no-default-features — 1642 tests pass (includes 11 firmware_registry unit tests)
• Firmware builds with CONFIG_CSI_MOCK_ENABLED=n (real WiFi mode) — ota_pull.c compiles without heartbeat.h dep
• GET /api/v1/firmware/latest with no firmware staged returns {"available":false}
• Upload a test binary → latest returns {"available":true, "version":"...", "sha256":"..."} → download and verify SHA-256 matches
• ESP32 node with older esp_app_desc.version polls and self-upgrades; node with matching version skips

[schwarztim]

Renumbered the ADR from 094 to 095 to avoid collision with PR #487 (body tracking platform), which was filed first. Force-pushed an updated commit with the rename: docs/adr/ADR-094-pull-based-ota.md → ADR-095-pull-based-ota.md, plus all comment references in main.rs and Cargo.toml updated.