v0.2.7

- Fix OTA rollback-confirmation crash (moved before Wi-Fi starts)
- Fix OTA SHA-256 chunked hashing
- Fix /setup POST body truncation, add XSS hardening
- Fix frame_pool init leak, JPEG EOI search UB
- config_mgr setter validation