feat(ota): add offline firmware update via web UI (jetkvm#1309)

Implements POST /ota/upload and POST /ota/apply endpoints for uploading
a .tar.gz archive containing a signed binary and SHA-256 hash file.
The handler extracts, verifies the SHA-256 digest, stages the binary at
/userdata/picokvm/bin/kvm_app or /userdata/picokvm/update_system.tar,
then reboots on apply.

Adds OfflineUpdateCard UI component to the Version settings panel,
surfacing app and system update slots with upload progress, verification
status, and one-click apply.

Adapted from upstream jetkvm#1309: replaced internal/ota package
references with fork's flat architecture; removed GPG verification
(fork has no trust-anchor infrastructure); adjusted storage paths from
/userdata/jetkvm/ to /userdata/picokvm/.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: terryrankine