feat(sdk): OTA 升级流程对齐 expo + 拆 extension 文件分层 + 秘钥本地化

主要改动：
- 新增 fetchLatestFirmware/upgradeFirmware/tryReportPendingUpgrade
  三段 OTA 接口，对齐 expo bindDeviceWithOrchestration 行为
- bind 仅做硬绑+getVersion，软绑/对账上报/拉最新固件搬到
  fetchLatestFirmware 内部串；软绑失败自动硬解回滚
- UpgradeRecord 复合主键 (sn, firmwareId) 持久化 + sn 级 in-flight 互斥
- DuooomiBleSDKDelegate 新增 didUpdateUpgradeRecords，集成方
  可观察对账上报结果（reported/outcome 状态）
- DuooomiBleSDK 主类按职责拆 5 个 extension 文件，公开 API 不变
- TargetFirmware 简化为只取必要字段 + 新增 forceUpgrade
- scanNamePrefix 改为必填 String
- demo 秘钥移至本地 DemoSecrets.swift (gitignored)
- README 重写：完整 OTA 流程示例 + 上报状态判定表

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Sources/DuooomiBleSDK/DuooomiBleSDKDelegate.swift

@@ -19,6 +19,13 @@ public protocol DuooomiBleSDKDelegate: AnyObject {
     func sdk(_ sdk: DuooomiBleSDK, didUpdateProgress progress: Int)
     /// 错误发生
     func sdk(_ sdk: DuooomiBleSDK, didEncounterError error: String?)
+    /// 升级记录变化（任何 `UpgradeRecord` 的新增 / 状态更新都会触发）。
+    /// 用来观察 `tryReportPendingUpgrade` 的对账上报结果：
+    /// - `record.reported = true, outcome = .success` → 上报成功且版本命中
+    /// - `record.reported = true, outcome = .versionMismatch` → 上报成功但版本不匹配
+    /// - `record.reported = true, outcome = nil` → 30 天 TTL 过期未上报
+    /// - `record.reported = false` → 还在尝试 / HTTP 失败，下次再试
+    func sdk(_ sdk: DuooomiBleSDK, didUpdateUpgradeRecords records: [UpgradeRecord])
 }
 
 /// 所有 delegate 方法提供默认空实现，调用方只需实现关心的方法。
@@ -31,4 +38,5 @@ public extension DuooomiBleSDKDelegate {
     func sdk(_ sdk: DuooomiBleSDK, didChangeActivation isActivated: Bool) {}
     func sdk(_ sdk: DuooomiBleSDK, didUpdateProgress progress: Int) {}
     func sdk(_ sdk: DuooomiBleSDK, didEncounterError error: String?) {}
+    func sdk(_ sdk: DuooomiBleSDK, didUpdateUpgradeRecords records: [UpgradeRecord]) {}
 }