fix: defer HA-triggered OTA execOTA() out of MQTT callback to main loop

Calling execOTA() directly inside the MQTT message handler blocked while
downloading firmware, causing MQTT to disconnect. Mirrors the forced-update
pattern: set _otaNonForcedPendingRequest in the callback and execute from
the main loop after MQTT processing is complete.

Closes #686

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: BrentIO

Controller/Controller.ino

@@ -112,6 +112,7 @@ WiFiClientSecure _otaHttpsClient;       /* TLS client used when the manifest URL
 String _otaManifestUrl;                 /* Set when setup_OtaFirmware() succeeds; empty otherwise */
 bool _otaUpdateInProcess = false;
 bool _otaPendingRequest = false;
+bool _otaNonForcedPendingRequest = false;
 bool _otaCheckFailed = false;           /* Set by onError during checkForUpdate(); reset before each check */
 int _otaCheckErrorCode = 0;             /* Error code captured by onError during checkForUpdate() */
 JsonDocument _otaPendingDoc;
@@ -976,6 +977,14 @@ void loop() {
 
   otaFirmware_checkPending();
 
+  if(_otaNonForcedPendingRequest && !_otaUpdateInProcess){
+    _otaNonForcedPendingRequest = false;
+    _otaUpdateInProcess = true;
+    _otaCurrentPartition[0] = '\0';
+    otaFirmware.execOTA();
+    _otaUpdateInProcess = false;
+  }
+
   oled.loop();
   authToken.loop();
   frontPanel.loop();
@@ -4375,7 +4384,7 @@ void eventHandler_mqttMessageReceived(char* topic, byte* pl, unsigned int length
     mqttClient.publish(topic, buffer);
 
     if(!_otaManifestUrl.isEmpty()){
-      otaFirmware.execOTA();
+      _otaNonForcedPendingRequest = true;
     }
     return;
   }