Add SoftAP battery PoC (apower/BMS/EMS socket read) with docs and tests

Probes 10.100.1.1:9000,18000, sends 0x19/0x1D/0x1E envelopes, extracts
currentBatterySoc/soc/avg(socArray). Includes offline extract_soc tests,
BATTERY_POC docs, README usage, and empirical port-9000 RE notes.

docs/RE_DART_FINDINGS.md

@@ -193,6 +193,25 @@ authS2C=2    "fwh/s2c/auth/"  mngC2S=5   "fwh/c2s/mng/"     deviceS2C  "fwh/s2c/
   - a `Duration` and retry loop (up to ~2 retries) are involved.
 - `BytesToInt16/Int16ToBytes` LE framing; `Socket Manager send object` / `receive object`.
 
+### Empirical — live aGate on its SoftAP (2026-10-13, from a client on `10.100.1.0/24`)
+
+Full TCP sweep of `10.100.1.1` (ports 1–65535): exactly **two** ports open — **53** and **9000**. No 80/443, no web UI, and **18000 (`0x4650`) is closed** on this unit.
+
+- **Port 53** — authoritative, *closed* DNS: well-formed `NXDOMAIN` for everything
+  (even `example.com`), no PTR for `1.1.0.100.in-addr.arpa`, no forwarding (the SoftAP
+  is an island). Serves some local name pattern we haven't identified yet.
+- **Port 9000** — a **length-prefixed framing service** (int16LE length), consistent
+  with the app's socket layer:
+  - every TLS `ClientHello` gets `UNEXPECTED_EOF` mid-handshake — first two bytes
+    `16 03` = int16LE `790`, so the decoder waits for a 790-byte frame that never
+    completes, then closes on idle;
+  - cleartext HTTP `GET` (`47 45` = `17735`) hangs forever (read timeout).
+  - A *complete* 147-byte frame (int16LE length + encrypted `QUERY_DEVICE_INFO`
+    envelope, `equipNo = X25160132`, key from `sum(utf8(sn))&0xFF`) is accepted
+    but met with **zero bytes** — every command tried (`0x00`/`0x01`/`0x02`/`0x06`)
+    and both key radices (16/32). Content-level rejection; the leading hypothesis is
+    `equipNo` validation against the real serial. **Pending: retry with the true SN.**
+
 ## 9. Bluetooth (BLE) transport — `communication_center/bluetooth`
 
 - `BluetoothManager` (singleton), `BluetoothStatus`: `closed / connected / connecting / interrupted`.
@@ -323,9 +342,15 @@ Still open:
 
 1. Exact BLE frame field order & the 2-byte magic semantics (confirm with `btsnoop`).
 2. Exact `encryptObject` radix + trailing-header handling.
-3. Local HTTP port + TLS behavior for `https://IP:PORT` (device self-signed cert?).
-4. Local socket port confirmation (`18000` candidate) and whether local RPC uses
-   socket vs `/terminal` HTTP vs local MQTT.
+3. ~~Local HTTP port + TLS behavior for `https://IP:PORT`~~ — **revised (2026-10-13,
+   §8 empirical):** no HTTP/TLS port exists on the device at all (only 53 + 9000).
+   Either local mode is socket-only on this firmware, or the HTTP service is
+   state-dependent and wasn't running. Revisit if a `/terminal` response is ever
+   captured from the SoftAP.
+4. ~~Local socket port confirmation~~ — **resolved on one unit (2026-10-13): `9000`**
+   (§8 empirical). The `0x4650` constant is not listening; the port may be
+   firmware-/device-dependent. Remaining: first confirmed RPC round-trip
+   (blocked on the real SN — see §8 empirical).
 5. Which class in `classes5.dex` sets the `X-Device-*` headers and their exact values
    (string-pool location confirmed; class binding in progress — §13).
 6. (Tooling, optional) Enable REA's DEX tools: obtain a **jadx-headless-mcp 0.7.1** JAR