feat: OTA TLS cert verification + CI release pipeline

Wire ESP-IDF's built-in 150-CA root bundle to the OTA HTTP client
so HTTPS OTA verifies server certificates. Pin bundle config in
sdkconfig.defaults. Replace dead artifact-copy step with Gitea
release creation on tag push. Bump CI container to IDF v5.5.

TASKS.md

@@ -57,6 +57,9 @@ Tracked separately in `~/git/esp32-web/TASKS.md`. Currently at v0.1.5.
 - [x] Remove unused `#include "esp_now.h"` (2026-02-14)
 - [x] Remove hardcoded default IP from Kconfig (2026-02-14)
 
+### P1 - High
+- [x] OTA TLS certificate verification via ESP-IDF CA bundle (2026-02-14)
+
 ### P2 - Normal
 - [ ] Tune presence threshold per room with real-world testing
 - [ ] Power consumption measurements using POWERTEST + external meter