Commands support, OAuth gateway plan, fee memo, trip-tool outage guidance

[zer0stars]

Summary

• Vehicle commands (lock/unlock/charge start/stop) via Devices API using the existing Vehicle JWT — with a hard safety gate: explicit per-command confirmation naming the exact vehicle, one command per confirmation, no auto-retry. New references/commands.md. Not live-fired in testing (real actuation); plumbing mirrors mcp-dimo's implementation.
• Known-issue guidance for telemetry_get_daily_activity / trip_segments (hang/empty body): --max-time 30, fall back to time-series, never loop-retry.
• Engineering plan for the OAuth 2.1 MCP gateway (claude.ai connector track): milestones M1-M4, gateway-not-telemetry-api decision, scope→privilege mapping, risks.
• Product memo: first-license fee options (sponsor first mint / rebate / user-auth free tier), recommendation A-then-C.
• Plugin 0.2.4.

Test Plan

• 11/11 unit tests, CI
• Skill text review: confirmation gate unambiguous
• Command live-fire deferred (needs a consented test vehicle with privilege 2)