Looks interesting, just wondering why you chose this architecture over the more standard "message to esp32 via mqtt then esp32 downloads firmware over https" route?
This architecture is IMHO simpler - you do not have any MQTT server or server for „hosting a new firmware”. You directly deploy new software like in a „standard workflow” where you send build artifacts to something with a public IP (in this example „public IP” is provided to ESP32 by Husarnet VPN)