Align SDK auth guidance and full-coverage policy

[MarcLeinenDE]

Align the SDK with the canonical API audit merged upstream.

Upstream baselines:

• API full-coverage audit: PR Add live-verified VPN profile management helpers #26
• API full-coverage test policy: PR Add mobile WAN connection control helpers #27

SDK changes:

• stop describing direct-IP administrator login as permanently unsuitable; the 2026-09-21 physical lifecycle proved successful login through http://192.168.1.1 after zyxel.home failed to resolve
• keep zyxel.home as the default, but document authority behavior as runtime/environment/state dependent
• update the pre-auth error hint and offline test accordingly
• pin the same full-coverage campaign rule in AGENTS.md: only router/eng_set_usb_mode is a hard mutation exclusion; all other documented capabilities remain coverage targets with appropriate gates/recovery
• document OTA download/install as a late-stage campaign item because firmware replacement can change the baseline

No protocol behavior is invented here; this is the SDK follow-up to already merged API evidence/policy.