Add open/close/stop_tonneau to TeslemetryVehicle - #185

Security Blast Radius

• inferred — A routed call can attempt the configured eligible backend chain, not necessarily a single vehicle if the caller mispairs objects. Effective exposure depends on each backend's vehicle identity and existing credentials; the new wrappers introduce no caller-supplied target or action parameter.

Trust Boundaries and Controls

• observed — Cloud commands retain the inherited bearer-token request path and VIN-specific endpoint. Bluetooth commands retain existing VIN-bound signing. Fallback selects another independently credentialed backend; the wrappers do not transfer Bluetooth authority into cloud credentials. Cloud-side token-to-VIN authorization is outside the inspected client source.

Resilience and Maintainability Implications

• observed — BluetoothUnconfirmedCommand is re-raised without cloud replay. Bluetooth write handling distinguishes provable pre-submission failure from ambiguous delivery, and sends use a per-domain session lock. Cancellation propagates rather than triggering router fallback, although it cannot undo an already submitted physical command. The router adds no cross-backend transaction, deduplication, or global ordering guarantee.

Hardening Proposals

• proposed — As defense in depth, consider validating matching VINs when constructing a VehicleRouter, or explicitly documenting and enforcing that precondition in consumers. This addresses an existing caller-owned invariant, not an established exploit introduced by this PR.