Add secure host CLI bridge and harden OTA workflows

Expose the Full Companion terminal over TCP and add an authenticated, replay-resistant host command service with documented CPU temperature, reboot, and allowlisted program examples.\n\nImprove LoRa OTA diagnostics and persistent CLI handling, reduce clock correction drift to ten minutes, and make mOTA stream flush behavior an explicit transport policy with regression coverage.

examples/host_cli_service/programs.example.json

@@ -0,0 +1,41 @@
+{
+  "programs": {
+    "fan": {
+      "argv": [
+        "/usr/local/bin/mesh-fan-control",
+        "--source",
+        "lora"
+      ],
+      "timeout_seconds": 3,
+      "arguments": [
+        {
+          "name": "state",
+          "type": "choice",
+          "choices": [
+            "on",
+            "off"
+          ]
+        },
+        {
+          "name": "minutes",
+          "type": "integer",
+          "min": 1,
+          "max": 60
+        }
+      ]
+    },
+    "label-status": {
+      "argv": [
+        "/usr/local/bin/mesh-label-status"
+      ],
+      "timeout_seconds": 3,
+      "arguments": [
+        {
+          "name": "label",
+          "type": "token",
+          "max_bytes": 24
+        }
+      ]
+    }
+  }
+}