Add support for Honor Smart Scale CH100S

[Piryus]

Summary

Adds BLE support for the Honor Smart Scale CH100S (Chipsea CST34M97 chipset), which advertises as "CH100S" over Bluetooth.

• Scale model: Honor Smart Scale AH100 (CH100S variant)
• BLE name: CH100S
• Chipset: Chipsea CST34M97, Bluetooth 4.1
• Link mode: CONNECT_GATT

Working features

• Weight — LE uint16, tenths of kg
• Body fat % — from scale, LE uint16, tenths of %
• Impedance — LE uint16, ohms
• Timestamp — from scale (year, month, day, hour, min, sec)
• Body composition — water %, muscle %, bone mass, BMR, visceral fat (computed app-side from impedance via EtekcityLib BIA formulas)
• Time sync — clock set on connect
• User sync — user profile (age, height, sex, weight) sent to scale
• History read — parses historical measurement frames

Protocol details

Reverse-engineered from the Huawei Body Fat Scale companion app (com.huawei.overseas.ah100) and verified by BLE packet capture against a physical CH100S device.

• Service: 0xFAA0 with TX 0xFAA1 (write) and RX 0xFAA2 (notify)
• Encryption: Measurement frames are AES-128-CTR encrypted (two 16-byte packets, each decrypted separately with IV reset), then MAC-XOR obfuscated
• Measurement frame (after decryption): [userId, weightLE(2), fatLE(2), yearLE(2), month, day, hour, min, sec, dow, impedanceLE(2)]
• USER_INFO (CMD 0x09): 14-byte payload, MAC-XOR then AES-CTR encrypted
• Auth flow: WAKEUP → AUTH (CMD 0x24) → setup (unit, clock, user info, version) → measurement

Why a separate handler from HuaweiAH100Handler

Although the CH100S shares the same BLE service UUIDs and auth flow as the CH100 (AH100), the data processing differs significantly:

1. Measurement frames require AES-CTR decryption (CH100 uses XOR-only)
2. Different decrypted frame layout (field positions and encodings differ)
3. USER_INFO encryption uses MAC-XOR-first-then-AES order with the initial key

A shared handler with conditional branches would be fragile and risk breaking existing CH100 support.

Files changed

• New: HuaweiCH100SHandler.kt — complete handler for CH100S
• Modified: ScaleFactory.kt — register the new handler

Test plan

• Scale detected as "Honor Smart Scale (CH100S)" in Bluetooth scan
• Connection and authentication succeed
• Weight matches scale display (verified across 5+ measurements at different weights: 2.9 kg, 70.9 kg, 71.0 kg, 71.4 kg, 74.2 kg)
• Body fat % is plausible (confirmed with user profile sync)
• Impedance reading is reasonable (~443 Ω)
• Timestamp from scale matches real time
• Body composition values (water, muscle, bone, BMR, visceral fat) are computed and displayed
• Compiled and tested on a physical Android device (Pixel) with a real CH100S scale

[oliexdev]

Thanks for your PR 👍