fix: address high-priority evaluation findings (hotfix batch)

[eman]

Fixes the highest-priority confirmed bugs from a comprehensive repo evaluation.

Changes

• mqtt/client.py: configure_reservation_water_program() referenced self._control, which is never assigned (the attribute is _device_controller), so every call raised AttributeError. Fixed the delegation and added a regression test that scans the module for references to the undefined attribute.
• CLI mode command: removed the vacation choice (mode 5 requires a day count that was never supplied, so it failed 100% of the time; use vacation DAYS) and the standby choice (0 is not a writable DhwOperationSetting value; use power off). Docs updated to match.
• CLI exit codes: click ignores callback return values in standalone mode, so the CLI always exited 0 even on failure. Failures now propagate via ctx.exit() and produce a non-zero exit code.
• Token cache security: ~/.nwp500_tokens.json (refresh token + AWS credentials) was written world-readable. Now created with mode 0600; existing files are tightened on save.
• Wrong-account token reuse: passing --email for account B while tokens for account A were cached silently ran commands against account A's session. Cached tokens are now discarded on email mismatch.
• OpenEI error masking: OpenEI reports application errors (e.g. invalid API key) in the body of an HTTP 200 response; these were reported as "no rate plans found". fetch_rates() now raises APIError with the API's message.
• Broken example: examples/advanced/mqtt_diagnostics.py imported from the nonexistent nwp500.mqtt_utils module and used deprecated datetime.utcnow().

Tests

• 17 new tests, including a new tests/test_token_storage.py (file permissions, roundtrip)
• Added an autouse fixture in test_cli_basic.py restoring logger levels mutated by the CLI group callback (previously leaked into test_utils when CLI extras are installed)

Validation

• pytest: 520 passed (CLI tests run with [cli] extras installed)
• ruff check / ruff format --check: clean
• pyright src/nwp500: 0 errors
• mypy src/nwp500: no issues

[Copilot]

Pull request overview

This PR delivers a batch of high-priority hotfixes across the MQTT client, CLI behavior, token-cache security, and OpenEI error handling, with regression tests and documentation updates to prevent recurrence.

Changes:

• Fix NavienMqttClient.configure_reservation_water_program() to delegate to the correct controller attribute and add regression coverage.
• Harden CLI behavior (remove unsupported mode choices, ensure non-zero exit codes on failure, and prevent cached-token reuse across different emails).
• Improve reliability/security and correctness via token file permission tightening and raising APIError for OpenEI “HTTP 200 with error body” responses; update docs/examples accordingly.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_token_storage.py	Adds token cache permission + roundtrip tests for CLI token storage.
tests/test_openei.py	Adds a regression test ensuring OpenEI application errors raise APIError.
tests/test_mqtt_client_init.py	Adds regression tests for MQTT client → device controller proxy delegation.
tests/test_cli_commands.py	Adds coverage ensuring removed mode values aren’t handled by the handler.
tests/test_cli_basic.py	Adds CLI behavior tests (invalid mode choices, non-zero exit codes, email mismatch behavior) plus logger-level isolation fixture.
src/nwp500/openei.py	Raises APIError when OpenEI returns an "error" object in a 200 response body.
src/nwp500/mqtt/client.py	Fixes delegation bug by using _device_controller instead of nonexistent _control.
src/nwp500/cli/token_storage.py	Writes token cache file with restrictive permissions (0600), including tightening existing files.
src/nwp500/cli/handlers.py	Removes unsupported standby/vacation from mode mapping and clarifies intent.
src/nwp500/cli/main.py	Discards cached tokens on email mismatch; uses ctx.exit() to propagate non-zero exit codes; removes unsupported CLI choices.
examples/advanced/mqtt_diagnostics.py	Fixes imports and replaces deprecated datetime.utcnow() usage.
docs/reference/python_api/cli.rst	Updates CLI docs to reflect removed mode choices and directs users to correct commands.
CHANGELOG.rst	Documents bugfixes and the token-cache permission security fix.