docs: protocol specs for InMotion V1 and Ninebot

Two more clean-room protocol specifications drawn from publicly
available research, primarily WheelLog's open-source adapters
(Ilya Shkolnik and contributors, GPLv3 — used as a reference for
protocol facts only, not as a source of code).

inmotion_v1.md (496 lines): the V8/V8F/V10/V10F/V5/L6 family that
predates the V14's V2 protocol. Documents the unique InMotion service
UUIDs (0xFFE4 notify, 0xFFE9 write), the AA AA / 55 55 framing with
byte stuffing, the 32-bit CAN-ID command map, fast/slow info offsets,
the 6-byte PIN handshake on 0x0F550307, and 17 model codes spanning
V5/V8/V10/L6/Lively/Glide3.

ninebot.md (616 lines): both Ninebot Z (Z6/Z10/new-stack E+) and the
legacy One E/E+/S2/Mini family. Documents the 5A A5 / 55 AA frames,
the 16-byte XOR keystream encryption used by the Z protocol (with
the GetKey 0x5B handshake to address 0x16), the parameter table from
0x10 to 0xF5, lock/unlock/speed-limit/alarm write templates, and the
read-only telemetry surface for legacy Ninebot.

Both feed the upcoming InMotion V1 and Ninebot adapters on this
branch — implementation will be original code in our project's idiom.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: eried