China a184 (P20) working fully local, both rrcheck renewal paths answered — first a184 validation of #199 #230

China-market P20 (roborock.vacuum.a184, factory 02.22.56),
blind-onboarded against local_roborock_server — no Roborock account,
no internet at any point. Working fully local since 29 Oct:

• commands (cleaning, modes, schedules) and maps, including editing
  ({"data": …, "need_retry": 1} wrapper)
• camera live view end to end through the stack's TURN relay
  (go2rtc ≥ 1.9.14; the mangled createca host is Camera live view does not require a short token.r: the mangled createca hostname is a post-handshake SAN check #229)

No -10002 since the grants were first answered. An automated daily
check (commands still work, renewals answered on both paths) has
passed every scheduled run: 30 Oct, 31 Oct, 1 Nov, 2 Nov.

Both renewal paths are answered:

• GET /devices/{did}/sh daily, via fw_check — the first a184 data
  point for PR fix(routes): support /devices/{did}/sh endpoint for access renewal on newer firmware #199's answer shape (previously verified on S7 and
  a143).
• POST /f/c at startup — capture and body format in China firmware renews rrcheck via POST /f/c to hardcoded api-cn.roborock.com (not just /devices/{did}/sh) — capture + body format #228. The
  hardcoded host can't be terminated with an honest certificate, so
  we front it with one minted from the compromised eMudhra
  intermediate keys, which this firmware's frozen trust store still
  accepts.

Caveat: factory firmware, never updated, never online.

Region-lock note: real api-cn's /location geolocates the client
IP, matching #81 / #161 / #182 (China units abroad locked once they
can reach the real CN API). Ours is offline and keeps working — those
units may be failing on the hardcoded /f/c path, not /sh.