Add SoftAP battery PoC (apower/BMS/EMS socket read) with docs and tests

Probes 10.100.1.1:9000,18000, sends 0x19/0x1D/0x1E envelopes, extracts
currentBatterySoc/soc/avg(socArray). Includes offline extract_soc tests,
BATTERY_POC docs, README usage, and empirical port-9000 RE notes.

README.md

@@ -11,6 +11,8 @@ Python client library for interacting with FranklinWH AGATE energy storage devic
 - **[Dart AOT Reverse-Engineering Findings](docs/RE_DART_FINDINGS.md)** — detailed protocol
   analysis recovered from the app's `libapp.so` with [blutter](https://github.com/worawit/blutter)
   (transports, wire envelope, command/topic enums, crypto/CRC, BLE framing, hotspot credentials).
+- **[Battery PoC](docs/BATTERY_POC.md)** — read charge % over the SoftAP socket
+  (`python -m franklinwh_agate_client.battery --sn <SN>`).
 
 ## Reverse Engineering Summary
 
@@ -51,6 +53,18 @@ client = AgateClient()
 device_info = client.query_agate_info(device_id)
 ```
 
+## Battery PoC (SoftAP socket)
+
+```bash
+python -m franklinwh_agate_client.battery --sn <20-char-SN> --show-hotspot
+python -m franklinwh_agate_client.battery --sn <20-char-SN>          # e.g. 78%
+python -m franklinwh_agate_client.battery --sn <20-char-SN> --raw
+```
+
+Probes `10.100.1.1:9000,18000`, sends `0x19/0x1D/0x1E`, prints
+`currentBatterySoc → soc → avg(socArray)`. Must run where the Wi-Fi adapter
+is on the device AP — see [Battery PoC](docs/BATTERY_POC.md).
+
 ## Local connect (device hotspot)
 
 The aGate runs its own SoftAP (gateway `10.100.1.1`); joining it is what