v36

OTA: insecure TLS, check first, drop the now-unneeded clock

Verified TLS can't fit the WiFi-fragmented heap (maxblk ~30k even pre-WebSocket,
confirmed on hardware), so the boot check failed "-1" regardless of total free
RAM. The clock-sync TLS always worked because it's insecure (no cert validation
= ~6k less) and runs first on a clean heap.

- checkForUpdate now uses setInsecure() for both the manifest fetch and the
  firmware download. Trade-off: no cert validation (a network MITM could serve
  fake firmware) — acceptable on a trusted LAN; can harden later by shrinking
  the mbedTLS content buffers via sdkconfig.
- Boot order: run the OTA check FIRST, before the clock sync and the WebSocket
  (cleanest heap). The earlier reorder (before the WS only) wasn't enough — WiFi
  itself caps the contiguous block.
- Clock is no longer required (insecure OTA + plain-HTTP Prime link); dropped the
  blocking NTP wait + HTTPS-Date sync to a single best-effort NTP for log stamps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>