Add admin firmware upload support

Implement authenticated HTTPS OTA uploads with bounded streaming, image
validation, reboot coordination, and lifecycle exclusion. Add the admin
UI,
regression tests, and Phase 10 acceptance documentation.

src/ssh_transport.c

@@ -13,6 +13,7 @@
 #include "esp_heap_caps.h"
 #include "esp_log.h"
 #include "esp_system.h"
+#include "web_firmware_update.h"
 #include "esp_timer.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/semphr.h"
@@ -265,6 +266,8 @@ static esp_err_t admin_console_perform(const admin_ssh_console_token_t *token,
     }
     switch (action) {
         case ADMIN_SSH_DEFER_REBOOT:
+            if (web_firmware_update_reserve_reboot() != ESP_OK)
+                return ESP_ERR_INVALID_STATE;
             esp_restart();
             return ESP_OK;
         case ADMIN_SSH_DEFER_STOP: