DRAFT. Maybe this should be split up into three PRs. When reviewing, review the individual commits.

Follow-up to #1837. Makes the per-provider index refresh handle slow, failing, and permanently-dead providers gracefully. Branch: tjj/ota-provider-health.

Changes

• Refresh provider indexes concurrently. get_ota_images() previously refreshed each compatible provider's index sequentially, so one slow or unreachable provider delayed every other by up to the 20 s fetch timeout — and dead providers are real (the ThirdReality and Inovelli servers shut down permanently), so the stalls stack up. Refreshes are now gathered concurrently; safe because each refresh only rebinds its own provider's cache bucket and swallows its own exceptions.
• Exponential backoff for failed index downloads. A failed download previously set _index_last_updated in a finally block, locking the provider out for the full 24 h expiration: a transient network blip at startup meant no OTA images from that provider for a day. Failures now retry after an exponentially growing delay (30 min base, doubling per consecutive failure, capped at the 24 h TTL), tracked separately from the success timestamp. invalidate_provider_caches() clears the failure state via the new provider.invalidate_index(), so a user-initiated re-check can always retry immediately.
• Expire images of providers down for a prolonged time. A provider that cannot be reached cannot withdraw images either, so a permanently dead provider would keep offering its last-known images until restart. When a refresh fails and the last successful refresh is older than STALE_INDEX_EXPIRATION_TIME (3 days), the provider's cached images are dropped with a single warning. Age-based (not failure-count-based) to avoid flapping update entities on intermittent connectivity; recovery repopulates on the next check.
• Warn about unverifiable trusted images once per refresh. The "trusted image lacks a SHA3-256 checksum" warning lived in the per-device matching path, so it fired for every device on every check cycle. The check now runs when a provider's index is refreshed: unverifiable trusted images are excluded from the cache up front (so they no longer appear in downgrades either) and the warning fires once per refresh, re-arming naturally on invalidation.

Notes

• New provider state: _index_last_success (monotone, not reset by invalidation, so it tracks true staleness), plus failure count/timestamp. New constants INDEX_RETRY_DELAY (30 min) and STALE_INDEX_EXPIRATION_TIME (3 days).
• The backoff exponent is capped (min(failures-1, 16)) to avoid a timedelta overflow.

Testing

New tests for concurrent refresh (a provider whose index load blocks until a second provider's load starts — a sequential refresh would stall), exponential backoff lifecycle, stale-provider expiry + recovery, and the once-per-refresh warning. Full suite passes; zigpy/ota/ at 99% coverage.