v0.4.0

Fixed

• Sites where the compact playback endpoint returns nothing now work (#13). Some sites answer .../playback/site/{id}/optimizers-compact with a header-only payload while the verbose .../optimizers endpoint returns the real measurements. async_get_energy_data now falls back to the verbose endpoint, shifting the window by the site's UTC offset (learned from measurementTime and cached) because the two endpoints disagree on whether the range is site-local or UTC.
• No more silent zeros. A header-only or malformed compressPowerData previously decoded into hourly slots with no values, so consumers recorded 0 Wh for every device with nothing logged. It now returns empty with a warning, and truncated or non-numeric headers no longer raise IndexError/ValueError.
• Wrong credentials now raise ClientResponseError with status 401 instead of a bare ClientError, so Home Assistant reports invalid_auth rather than cannot_connect. It still subclasses ClientError, so existing handlers are unaffected.
• Login is no longer repeated on every call. SolarEdge stopped setting SolarEdge_SSO-1.4; the session cookie is se_monitoring_auth. The one-hour fast path never matched, so a single Home Assistant refresh ran three complete OAuth flows and two layout fetches. It is now one of each. Cookie domains are matched by suffix, and the layout cache is only cleared once a new session is established.
• Authorize and token-exchange response bodies are drained so connections return to the shared session pool.

Security

• Credentials are only posted to, and authorization codes only accepted from, hosts on solaredge.com. Login form inputs are scraped from the matched <form> rather than the whole page.

Other

• The CLI reads credentials from a .env file or the environment (SOLAREDGE_USERNAME, SOLAREDGE_PASSWORD, SOLAREDGE_SITE_ID).

No public API changes: SolarEdgeWeb, its methods, and EnergyData keep identical signatures.