Events

I can't see why you would need a LIFO. At startup I'd simply discard all messages that queued up while offline, to keep the device simple.

Regarding security:

• When going with the Google Mini local API http is ok (ESP8266 doesn't support https).
  
• When connecting to the internet you should verify the identity of the server using https (ESP32 supports https).
  
• In both cases keep in mind that Espruino has a local telnet and OTA server running in the default firmware, that is nice for development but also a potential security risk during operations in a customer WLAN.
  
  

Instead of http/https polling you could use websockets, which are much easier to implement in nodejs/esprunion compared to C++. It's an outgoing http (or https) connection as you're using right now, no firewall change required. The only difference is that you "upgrade" the connection once, and then you can send "messages" instead of http requests. Having a tested solution with polling I wouldn't change it, unless you have to scale up.