Add firewall filter list reads

[MarcLeinenDE]

Adds the two remaining safe lower-level firewall filter list reads to client.firewall using physically confirmed minimal request bodies.

Scope:

• client.firewall.ip_filter() → firewall/ww_read_ip_filter
• client.firewall.port_filter() → firewall/ww_read_port_filter
• direct authenticated POST
• exact bodies: {"ww_ip_filter":{"list":[]}} and {"ww_port_filter":{"list":[]}}
• raw firewall.list entries are preserved without inventing a non-empty rule schema

Upstream evidence:

• both methods are LIVE_VERIFIED, ADMIN_OK, READ_OR_LOW_SIDE_EFFECT
• 2026-09-08 ACIY.3 normal-admin probe confirmed empty-list bodies are accepted through direct POST
• both responses exposed firewall.list as a JSON list and firewall.setting_response as a string
• tested router returned zero configured entries for both lists
• upstream API evidence is recorded in nr2301-api PR Add timed reboot schedule helpers #3

Physical SDK evidence (2026-09-08):

• targeted test_firewall_reads passed 1/1 in 1.82 s on Python 3.13.5
• both high-level helpers succeeded with the exact empty-list POST bodies
• no rule contents, IP addresses or ports were printed
• no firewall rule/mode/state write occurred

Documentation:

• CHANGELOG records helper and physical validation
• docs/firewall-filter-read.md records request shape, schema boundary, privacy and evidence

Validation:

• initial PR CI run #243: Python 3.10/3.11/3.12/3.13 and package all SUCCESS
• final PR diff reviewed; only intended SDK/test/documentation changes remain