canbus: confirm command path live + frame docs as device integration

Command path proven end to end on the bus (node F8 interior lights, on/off/on),
each answering a distinct fresh challenge; bare opcodes without the exchange are
ignored. ids_can_auth.h verified bit-exact against ids_can_auth.py and the
captured/live pairs.

- idscan_cmd.py: stdlib socketcan tool running the full page-42/43 exchange
- esphome/onecontrol-canbus.yaml: correct IDS-CAN read dispatch (was stale RV-C
  DGN code) + command path wired to the auth header
- README/memory: document the read map + command authentication; rename
  sniff/ -> captures/; neutral device-integration framing throughout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

canbus/captures/auth-pairs-multinode-2026-06-11.txt

@@ -0,0 +1,34 @@
+# Lippert IDS-CAN command-auth challenge/response pairs — MULTI-NODE
+# Captured 2026-06-11, app-driven (phone app issued on/off/move commands).
+# Source log: app-commands-2026-06-11_230059.log  (node 2A bulk set lives in 2A-auth-pairs.txt).
+#
+# Exchange (controller node 01 <-> module node), all 29-bit extended frames:
+#   id = (src<<18) | (dir<<16) | (dest<<8) | page    dir: 0 = 01->node, 1 = node->01
+#   arm       01->node  page42  DLC2  "00 04"
+#   challenge node->01  page42  DLC6  "00 04 <CC CC CC CC>"
+#   response  01->node  page43  DLC6  "00 04 <RR RR RR RR>"
+#   ack       node->01  page43  DLC2  "00 04"
+# format below: <challenge_hex> <response_hex>  (the 4-byte payload tails)
+#
+# Confirmed: the SAME handshake gates every node tested — switched loads AND the
+# awning (movement class). 51 pairs total across 4 nodes; response = f(challenge)
+# is nonlinear (not GF(2)-affine, not Z/2^32-affine, full byte diffusion).
+
+# node 61 — water pump (type 0x1E switched load)
+61 FE06BF48 58AEA9BE
+61 D57BE45A A1FB45E1
+
+# node 75 — awning (type 0x21 H-bridge/movement) — full nonce gate, same as loads
+75 A009E94C 5ADC2B0D
+75 5F8A7647 4CA89152
+75 6A873757 02592CF2
+
+# node F8 — interior lights (type 0x1E switched load)
+F8 F7740A20 BDB16954
+F8 EDC9281A 87EFB3EF
+
+# node 2A — exterior lights (type 0x1E) — 2 extra pairs from this session;
+# 42 more in 2A-auth-pairs.txt (extlight-authpairs-*.log). 21CA0C06 is the pair
+# the README used to rule out the BLE TEA key.
+2A 21CA0C06 CC18366B
+2A 4FC2C0FF 2B47861E