Fix multipart V2 NC onboarding and prepare v1.1.0-rc2

[Lash-L]

Multipart POST /nc requests were logged as NC Prepare, but the URL-encoded body parser missed their device ID and provisioning fields. Even with a recovered public key, the server could return a plaintext response and leave the vacuum's NC step missing. This parses multipart text fields with Starlette/python-multipart so the existing NC handler selects the device key, preserves provisioning values, and records the request against the vacuum. Raw request bytes remain intact for capture metadata; URL-encoded and JSON behavior is preserved.

Bump the package and opt-in Roborock Local Server Beta add-on to 1.1.0-rc2. The stable add-on remains unchanged at 1.0.2, and the existing prerelease workflow continues to exclude stable image aliases.

The available Q7 firmware's alternate RSA request builder uses multipart form data, and an ASGI reproduction matched the missing-NC/plaintext-reply symptoms in Pieter's report. His exact a298 NC body was not available, so this fixes a demonstrated server bug without claiming complete hardware onboarding. Response encryption and the experimental V2 status label retain their existing behavior.

Validation

• uv run --locked pytest -q — 212 passed (one existing pytest configuration warning).
• uv run --locked mkdocs build --strict
• uv build and uv lock --check
• Independent subagent review of the parser, tests, and beta release isolation.

New regression coverage sends multipart and URL-encoded NC requests through the real ASGI app with a known synthetic RSA-4096 key, independently decrypts the response, and checks device/session attribution. It also covers the injected path prefix, quoted boundaries, repeated/blank fields, Unicode and literal plus/percent values, original body preservation, malformed input, and file-part rejection.

Beta retest

After merging and publishing the v1.1.0-rc2 prerelease image:

1. Update and restart Roborock Local Server Beta. Keep existing settings, samples, and recovered keys.
2. Enable new connections and repeat pairing after the public key is available. No state wipe or repeat key recovery is needed for this fix.
3. Check that /nc is attributed to the vacuum, response_json.result is an encrypted string, and the NC step is recorded. The V2 unsupported banner can remain.
4. Check for authenticated MQTT traffic, a status/command response, and reconnection. If pairing still stops, retain redacted NC content-type/field names, response shape, and MQTT/TLS logs from the attempt.