fix(upgrade): correct appendData params to {"length": N} (hardware-validated)

Reversed from the hunter CUpgradeService::appendData handler and confirmed by a
live UART-free flash on a GK7205V510: appendData expects params {"length": N}
with an N-byte binary payload (the handler checks params.length == actual binary
length), NOT {"Offset","Length"} — which returned 400 "param error". prepare
({"Type":"System"}) and execute params are ignored. State machine: prepare(0->2)
-> appendData(2/4, repeatable) -> execute(4->0), with a ~60s idle timeout.

With this, DahuaClient.upgrade_firmware() successfully flashed an OpenIPC package
over DHIP end-to-end (device rebooted into the new firmware). const comment
updated to record the byte-proven param shape.

Author: widgetii

dahua/client.py

@@ -494,7 +494,7 @@ def upgrade_firmware(self, path: str, *, confirm: bool = False,
                 if not chunk:
                     break
                 resp, _ = self.request(const.UPGRADER_APPEND,
-                                       {"Offset": sent, "Length": len(chunk)},
+                                       {"length": len(chunk)},
                                        data=chunk)
                 self._check(resp, const.UPGRADER_APPEND)
                 sent += len(chunk)

dahua/const.py

@@ -69,10 +69,10 @@
 # -- firmware upgrade -------------------------------------------------------
 # The `hunter` daemon's RPC upgrade handlers (reversed on a Zenointel GK7205
 # camera): prepare -> appendData(chunk) -> execute; getState is read-only. These
-# are the same handlers the web /cgi-bin/upgrader.cgi bridges to. The JSON param
-# names below (Type / Offset+Length) match the reversed "append upgrade data"
-# stream but are not byte-proven — verify against upgrader.getState / a web
-# capture before trusting a real flash.
+# are the same handlers the web /cgi-bin/upgrader.cgi bridges to. Validated on a
+# GK7205V510 (hunter decompile + live flash): appendData takes params {"length": N}
+# with an N-byte binary payload; prepare/execute params are ignored. State machine:
+# prepare(0->2) -> appendData(2/4, chunks) -> execute(4->0); ~60s idle timeout.
 UPGRADER_STATE = "upgrader.getState"
 UPGRADER_PREPARE = "upgrader.prepare"
 UPGRADER_APPEND = "upgrader.appendData"