China firmware renews rrcheck via POST /f/c to hardcoded api-cn.roborock.com (not just /devices/{did}/sh) — capture + body format #228

The finding

On a China-market P20 (roborock.vacuum.a184, factory 02.22.56,
blind-onboarded against local_roborock_server, never online), rrcheck
renews on two paths:

1. GET /devices/{did}/sh on the token host, roughly daily — the
   path PR fix(routes): support /devices/{did}/sh endpoint for access renewal on newer firmware #199 answers.

2. POST /f/c to https://api-cn.roborock.com/f/c at every
   startup. The host is hardcoded, not derived from token.r. Form
   body, signed like its other firmware-API calls (checkda,
   createca) with RSA-SHA1:

   cpuid=<32-hex>&did=&pid=&platform=RR&sn=&tz=Asia%2FShanghai&uid=&signature=

Packet capture shows the robot opening TLS 1.3 to
api-cn.roborock.com twice per boot. Until we fronted that host, the
handshake failed hostname validation and no HTTP request was ever
sent — so this path never shows up in local server logs. An absent
/f/c (#161, #182) is not evidence the firmware doesn't call it.

Consequences:

• With only fix(routes): support /devices/{did}/sh endpoint for access renewal on newer firmware #199, these robots may run on the startup grant plus /sh
  alone. The G20S Ultra (a143), 02.52.78: L01 get_status rejected with -10002 after local onboarding #81 / Compatibility report: G30 China (Saros 10) — can onboard but doesn't work #161 / China-market G20S (a96): method-selective -10002 rrcheck access denied despite working local MQTT/HTTPS #182 units (China, -10002) may be failing
  on this path, not /sh.
• Real api-cn is live, and its /location geolocates the client IP
  — a China unit with internet reaches the real CN API and is told
  where it is. Ours gets silence and keeps working.

What we could not do

Terminate that TLS honestly — no CA will issue for
api-cn.roborock.com. We front it with a certificate minted from the
publicly-compromised eMudhra intermediate keys
(emudhra.we-have-a-problem.com), which this firmware's frozen trust
store still accepts. Happy to expand on the method; the capture stands
without it.