v0.2.5

fix: move recovery_mgr_init before Wi-Fi, port SHA-256 to PSA Crypto

- recovery_mgr_init() called nvs_commit() after Wi-Fi and MQTT were
  already running. nvs_commit disables the OPI PSRAM cache; concurrent
  PSRAM access by Wi-Fi/MQTT tasks caused ExcCause=7 crash (confirmed
  via coredump: wifi task crashed while main task was at
  recovery_mgr.c:67 nvs_set_i32). Fix: move recovery_mgr_init() to
  before wifi_init_sta() — no PSRAM-accessing tasks are alive at that
  point, making the NVS write safe.

- sha256_buffer() used legacy mbedtls_sha256_* context API which was
  removed in mbedTLS 4.0 (IDF v6). Replaced with psa_hash_compute()
  from PSA Crypto API, compatible with both IDF v5 (mbedTLS 3.x) and
  IDF v6 (mbedTLS 4.0). Fixes CI build failure on IDF v6 job.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>