This PR adds the core NGIOT transport and SST authentication plumbing.

It is the first PR in a staged NGIOT implementation split. The intent is to keep the change reviewable and release-safe before adding command handling, MQTT numeric-topic routing, hardware profile support, or map support.

In scope

• Add SST authentication support for NGIOT requests.
• Add a thin NGIOT endpoint-control client.
• Add minimal authentication integration needed to attach the NGIOT stack.
• Add unit coverage for NGIOT client behaviour.
• Add unit coverage for SST authentication behaviour.
• Add unit coverage for authentication teardown/integration behaviour.

Out of scope

• NGIOT command abstractions.
• Individual NGIOT commands.
• MQTT numeric-topic routing.
• eyfj07 hardware profile enablement.
• Map parser/state handling.
• Rust/LZ4/raster rendering.
• Any user-facing NGIOT device support.

Overall goal

The end goal is to add support for NGIOT-based devices, including the eyfj07 printer, in a staged and reviewable way.

Planned sequence:

1. NGIOT transport and SST authentication
2. NGIOT command base
3. Core NGIOT commands
4. MQTT numeric topic routing
5. eyfj07 hardware profile without map support
6. NGIOT map parser/state handling
7. Rust LZ4/raster rendering support
8. NGIOT map commands and map enablement

Release safety

This PR keeps main releasable because it only adds internal transport/authentication plumbing.

It does not expose a new hardware profile, does not route NGIOT MQTT messages, does not add NGIOT commands, and does not enable map support.

Testing

• uv run --python 3.14 pytest tests/test_ngiot_client.py tests/test_sst_authentication.py tests/test_authentication_ngiot.py
• uv run --python 3.14 mypy deebot_client/ngiot_client.py deebot_client/sst_authentication.py tests/test_ngiot_client.py tests/test_sst_authentication.py tests/test_authentication_ngiot.py
• uv run --python 3.14 prek run ruff-check --files deebot_client/ngiot_client.py deebot_client/sst_authentication.py tests/test_ngiot_client.py tests/test_sst_authentication.py tests/test_authentication_ngiot.py
• uv run --python 3.14 prek run ruff-format --files deebot_client/ngiot_client.py deebot_client/sst_authentication.py tests/test_ngiot_client.py tests/test_sst_authentication.py tests/test_authentication_ngiot.py
• uv run --python 3.14 prek run --all-files except unrelated existing mypy baseline failures

Known unrelated full-prek mypy baseline failures:

• tests/rs/test_map.py
• tests/test_mqtt_client.py
• tests/test_device.py
• tests/commands/xml/test_life_span.py