Standalone (non-HomeBase) camera authentication and media route

[keesmod]

Goal

Establish one evidenced authentication, command and recording route for cameras that do not sit behind a HomeBase 3 (T8030), so the families that are already recognised can get real state, events and media.

Current state (0.12.3)

• Only the H3 LAN-derived credential route exists. Standalone descriptors are recognised and keep their own identity, but every operation returns standalone_transport_unverified. No DSK/cipher route is implemented and the legacy security-cloud fallback is deliberately not used.
• Recognised but inactive: wired doorbells T8200/T8201/T8202 (type 5), T8203 (type 93); garage T8452 (132), T8453 (133); standalone SoloCam and wall-light descriptors; LTE T8150 (110).
• Research and limits: docs/research/CAMERA_TRANSPORTS_2026-09-11.md, docs/WIRED_DOORBELLS.md, docs/GARAGE.md, docs/LTE.md, docs/SOLOCAM.md, docs/WALLLIGHT.md.

What unblocks this

1. A sanitized Mega inventory descriptor for one standalone camera from an owner (no serials/tokens).
2. Evidence of the standalone authentication handshake and one live/snapshot/recording command lifecycle on that device.
3. Then: implement the route behind a typed profile, add fixtures, and admit the exact model/type pairs one at a time.

Scope notes

No PTZ, talkback, lock/door/garage actuation or settings. Whole-family support is never inferred from one model.

Consolidates #27, #28, #33, #34 and the open parts of research #36 and #37.