Add admin firmware upload support

Implement authenticated HTTPS OTA uploads with bounded streaming, image
validation, reboot coordination, and lifecycle exclusion. Add the admin
UI,
regression tests, and Phase 10 acceptance documentation.

src/web_firmware_update.h

@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+#include "esp_http_server.h"
+
+#define WEB_FIRMWARE_UPDATE_URI "/api/firmware"
+
+esp_err_t web_firmware_update_handler(httpd_req_t *request);
+
+/* Atomically exclude uploads until reset. Call immediately before an ordinary
+ * reboot (and before any acknowledgement delay); failure means do not reset.
+ * Independent of HTTPS initialization, so UART0 recovery remains available. */
+esp_err_t web_firmware_update_reserve_reboot(void);
+
+/* Internal HTTPS owner reservation. HTTPD takes before flash and releases on
+ * failure; successful response transfers lifetime to the reboot owner. No
+ * service mutex is held during receive/flash/response. Implemented by server. */
+esp_err_t web_firmware_update_reserve(httpd_handle_t server);
+void web_firmware_update_release(void);