feat: add Ethernet OTA support for RP2350/W5500 boards

[cvaldess]

Summary

• Adds over-the-air firmware update via Ethernet (W5500) for RP2350-based boards
• New TCP server on port 4243 using the MOTA protocol: SHA256 challenge-response auth + CRC32-verified transfer
• Python upload tool (bin/eth-ota-upload.py) — stdlib-only, auto GZIP-compresses firmware before upload
• Watchdog (8s) enabled in rp2040Loop() so the device recovers if an OTA write stalls

Depends on: #10135 (Raspberry Pi Pico 2 + W5500 + E22-900M30S variant) — please review that PR first.

Protocol

1. Device sends a 32-byte random nonce
2. Client responds with SHA256(nonce || PSK) — constant-time comparison on device side
3. Client sends 12-byte header: "MOTA" magic + firmware size (LE u32) + CRC32 (LE u32)
4. Firmware transferred in 1 KB chunks; device verifies CRC32 and calls Update.end() (picoOTA)
5. Device reboots — bootloader applies the update from LittleFS

The PSK defaults to meshtastic_ota_default_psk_v1!!! and can be overridden per-build via USERPREFS_OTA_PSK.

Files changed

File	Change
src/mesh/eth/ethOTA.cpp	New — OTA TCP server implementation
src/mesh/eth/ethOTA.h	New — public API: initEthOTA(), ethOTALoop()
bin/eth-ota-upload.py	New — Python upload tool
src/mesh/eth/ethClient.cpp	Hook initEthOTA() after connect, ethOTALoop() every 5s
src/platform/rp2xx0/main-rp2xx0.cpp	Enable watchdog 8s in rp2040Loop()
variants/rp2350/pico2_w5500_e22/platformio.ini	filesystem_size=0.75m, -D HAS_ETHERNET_OTA

Usage

# Build
pio run -e pico2_w5500_e22

# Upload OTA (device must be connected to Ethernet with IP assigned)
python bin/eth-ota-upload.py --host 192.168.1.100 .pio/build/pico2_w5500_e22/firmware-*.bin

# With custom PSK
python bin/eth-ota-upload.py --host 192.168.1.100 --psk mySecretKey firmware.bin

Test plan

• Build succeeds with HAS_ETHERNET_OTA (pio run -e pico2_w5500_e22)
• OTA upload completes and device reboots with new firmware
• CRC mismatch correctly rejected
• Wrong PSK correctly rejected (with cooldown)
• Build without HAS_ETHERNET_OTA (other boards) unaffected — all code guarded

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds Ethernet-based OTA update support for RP2350 + W5500 boards in the Meshtastic firmware, integrating a new OTA TCP server into the existing Ethernet client flow and providing a companion upload tool and RP2350 variant configuration.

Changes:

• Introduces a new Ethernet OTA server (TCP/4243) using the MOTA protocol with PSK-based SHA256 auth and CRC32 verification.
• Adds a stdlib-only Python uploader that GZIP-compresses firmware before transfer.
• Adds/updates RP2350 Pico 2 + W5500 + E22-900M30S variant configs/docs and enables an RP2xxx watchdog loop.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/mesh/eth/ethOTA.cpp	Implements Ethernet OTA server, auth, transfer, CRC verification, and reboot staging.
src/mesh/eth/ethOTA.h	Declares OTA server init/loop API behind feature guards.
bin/eth-ota-upload.py	Implements client-side MOTA upload with GZIP + SHA256 challenge-response.
src/mesh/eth/ethClient.cpp	Hooks OTA init after Ethernet connect and polls OTA loop periodically; adds W5500 SPI0 init path.
src/platform/rp2xx0/main-rp2xx0.cpp	Enables and feeds an 8s watchdog in rp2040Loop().
src/platform/rp2xx0/architecture.h	Maps WIZNET_5500_EVB_PICO2 builds to PRIVATE_HW vendor model.
src/mesh/api/ethServerAPI.h	Adds conditional include of Ethernet.h for the W5500/Pico2 path.
src/DebugConfiguration.h	Adds conditional include of Ethernet.h for the W5500/Pico2 path.
variants/rp2350/pico2_w5500_e22/platformio.ini	Adds new env with Ethernet OTA flag, bigger filesystem, and Ethernet library dependency.
variants/rp2350/pico2_w5500_e22/variant.h	Defines pins/capabilities for Pico2 + W5500 + E22 wiring.
variants/rp2350/pico2_w5500_e22/README.md	Documents wiring/build/network usage and technical notes for the variant.
variants/rp2350/pico2_w5500_e22/wiring.svg	Adds a wiring diagram for the Pico2/W5500/E22 setup.

[cvaldess]

All four Copilot review items were addressed in e9ac820:

• OTA_ERR_TIMEOUT moved 0x06 → 0x08 so it no longer collides with OTA_ACK
• USERPREFS_OTA_PSK handled as char[] + sizeof-1 to strip the PlatformIO-stringify trailing NUL
• Auth cooldown path now calls client.stop() silently instead of writing a byte that the client would mis-consume as part of the nonce
• README TX_GAIN_LORA value corrected to 7 for EBYTE_E22_900M30S

bfd2c94 follows up on the protocol-code change on the client side: bin/eth-ota-upload.py previously mapped 0x06 → Timeout, which stopped matching once 0x08 became the timeout code. The mapping is now aligned with the full OTAResponse enum (0x00–0x08) so every firmware response prints a human-readable message.

Ready for maintainer review whenever you have a moment — happy to rebase again if needed.