usb-medical

Firmware update guard: ```c // REQ-USB-OTA-02; TEST-USB-07 int handle_fw_update(const uint8_t *buf, size_t len) { if (!verify_signature(buf, len)) return -1; return apply_update_atomically(buf, len); } ```