Implement V2 API authentication with HMAC-SHA1 signing

[piekstra]

Summary

Migrates from the deprecated V1 cloud API to the V2 API protocol used by the current Kasa Android app (v3.4.451). This is the core auth infrastructure for v5.0.

New modules:

• signing.py - HMAC-SHA1 request signing using AccessKey/SecretKey extracted from the Kasa APK
• exceptions.py - Custom exception hierarchy: TPLinkCloudError, TPLinkAuthError, TPLinkMFARequiredError, TPLinkTokenExpiredError, TPLinkDeviceOfflineError
• certs/ - Bundled TP-Link private CA certificate chain for SSL verification with V2 API servers

Updated modules:

• client.py - V2 login flow with regional URL discovery, MFA callback support, refresh token management, HMAC-signed requests
• device_client.py - HMAC signing and TP-Link CA SSL on all device passthrough requests
• device_manager.py - New mfa_callback parameter, refresh token storage/retrieval, automatic token refresh on expiry
• api_response.py - Added error_code and msg properties
• __init__.py - Export new exception classes
• setup.py - Bundle certs as package data, require Python 3.10+

Key technical details:

• V2 login: getAccountStatusAndUrl → regional URL → login (flat JSON body, no method/params wrapper)
• Device operations unchanged: still use V1 JSON format ({"method": "passthrough", ...}) on root path, but with V2 signing headers
• All requests include HMAC-SHA1 signature in X-Authorization header and Content-MD5 header
• Query parameters match the Kasa app's OkHttp interceptor chain (C29914q)

Verified working end-to-end against the live TP-Link API:

• Login with regional URL discovery
• Device listing (17 parent devices, 35 total with children)
• Device control (passthrough commands)

Closes #83, #84, #85, #86, #87, #88, #96

Test plan

• V2 login succeeds with real credentials
• Regional URL discovery works (returns n-use1-wap.tplinkcloud.com)
• Token and refresh token returned from login
• Device listing returns all 17 devices
• Device passthrough commands work (get_sys_info, set_relay_state)
• Creating TPLinkDeviceManager without credentials still works (regression TPLinkDeviceManager does not initialise _auth_token unless username and password are provided #75)
• All imports resolve correctly
• Signing module produces valid HMAC-SHA1 signatures
• CA cert bundle loads and SSL verification succeeds
• MFA flow (requires 2FA-enabled account to test)
• Token refresh flow (requires expired token)
• Wiremock tests need updating for V2 endpoints (Update mock API server for V2 testing #97)