fix: use DB wildcard address 0x8A11FFFF for list_datablocks

V1-initial PLCs reject EXPLORE to object 3 (PLC_PROGRAM_RID) with
V254. TIA Portal explores 0x8A11FFFF (DB_ACCESS_AREA_BASE + 0x3FFFF)
instead, which returns the full program tree with DB children.

Author: gijzelaerr

s7/_s7commplus_client.py

@@ -369,7 +369,9 @@ def list_datablocks(self) -> list[dict[str, Any]]:
             raise RuntimeError("Not connected")
 
         if self._connection._session_key is not None:
-            payload = _build_explore_payload_v3(Ids.NATIVE_THE_PLC_PROGRAM_RID)
+            # V1-initial PLCs: explore the DB wildcard address (0x8A11FFFF)
+            # matching TIA Portal's browse pattern
+            payload = _build_explore_payload_v3(0x8A11FFFF)
         else:
             payload = _build_explore_request(
                 Ids.NATIVE_THE_PLC_PROGRAM_RID, [Ids.OBJECT_VARIABLE_TYPE_NAME, Ids.BLOCK_BLOCK_NUMBER]