0.6.38 — upstream sync, per-car service targeting and credential VIN checks

Synchronizes this fork with upstream 0.6.38 and its latest main commit (d46f035), including 0.6.37.

• Every xpeng.* service accepts an optional vehicle_entity_id to choose which car it acts on; omitting it keeps the first-entry behaviour, and the HVAC schedule services refuse to guess on multi-car installs.
• xpeng.import_credentials refuses a credential pair whose VIN belongs to another car, and each config entry signs with its own device id (fixes "Login status expired" with two cars).
• A REST widget odometer of -1 is treated as "no data" rather than a replay, and never reaches the odometer sensor.
• While the push stream is silent, the widget is still polled at rest_scan_interval, so a car that starts driving is noticed in minutes.
• Renewal app 0.1.23: each app slot writes its own last-run log.

The integration, vehicle card, renewal apps and vendored runtime match upstream. The fork retains its issue-tracker URL and publishing configuration, with one consolidated commit ahead of upstream. Previous history is archived under archive/main-before-upstream-sync-20261102; existing release tags are preserved.

Validation: isolated Python regression runner (75/76 scripts, 1 skipped for an optional dependency) and standard unittest discovery (1162 tests) pass on Python 3.12.

Update the integration through HACS and restart Home Assistant. Companion apps are versioned and updated separately.