feat(firmware): wire OTA updater into main loop with 6-hour polling task

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

firmware/lib/ota_updater/library.json

@@ -0,0 +1,6 @@
+{
+  "name": "ota_updater",
+  "build": {
+    "flags": ["-I$PROJECT_INCLUDE_DIR"]
+  }
+}

firmware/src/main.cpp

@@ -11,6 +11,7 @@
 #include "event_log.h"
 #include "net_guard.h"
 #include "version.h"
+#include "ota_updater.h"
 #include <esp_system.h>
 #include <esp_task_wdt.h>
 
@@ -94,6 +95,15 @@ static void task_camera(void*) {
     }
 }
 
+static void ota_task(void*) {
+    for (;;) {
+        if (WiFi.isConnected()) {
+            ota_updater_check_and_apply();
+        }
+        vTaskDelay(pdMS_TO_TICKS(21600000UL)); // 6 hours
+    }
+}
+
 // Hourly reporter task — runs on core 0
 static void task_reporter(void*) {
     uint32_t last_report_ts = 0; // 0 = not initialized yet
@@ -270,6 +280,16 @@ void setup() {
 
     xTaskCreatePinnedToCore(task_camera,   "cam",  8192, nullptr, 2, nullptr, 1);
     xTaskCreatePinnedToCore(task_reporter, "rep",  8192, nullptr, 1, nullptr, 0);
+
+    // static: ota_updater stores raw pointer; must outlive setup()
+    static String s_ota_base = String("http://") + REPORTER_API_HOST_NAME + ":" + REPORTER_API_PORT;
+    ota_updater_init(
+        s_ota_base.c_str(),
+        g_cfg.device_id.c_str(),
+        g_cfg.hmac_secret.c_str(),
+        21600000UL
+    );
+    xTaskCreate(ota_task, "ota", 8192, nullptr, 1, nullptr);
 }
 
 void loop() {