lalo-orders device server
  GET  /healthz
  POST/GET /xiaozhi/ota/
  GET /firmware/<file>      (Bearer / X-Api-Key / ?key=)
  WS  /orders?key=...
  POST /api/orders          (Bearer / X-Api-Key)
  GET  /o/<id>
  GET  /api/orders/<id>     (Bearer / X-Api-Key)
  POST /api/ota             (Bearer / X-Api-Key)
  POST /api/touch_cal       (Bearer / X-Api-Key)
  GET  /api/status          (Bearer / X-Api-Key)