Support APS_Encryption transmit option

[TheJulianJES]

zigpy sets TransmitOptions.APS_Encryption for unicasts that require APS layer encryption (currently the Zigbee Direct Configuration cluster, which rejects unencrypted frames with NOT_AUTHORIZED). Map it onto deCONZ's SECURITY_ENABLED TX option.

APS security uses the (trust center) link key, so USE_NWK_KEY_SECURITY must not be set at the same time.

Related zigpy PR that requires this (but zigpy-deconz doesn't require a new zigpy version):

• Add Zigbee Direct Configuration cluster zigpy#1867

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.14%. Comparing base (d7d73ba) to head (61b1448).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #277   +/-   ##
=======================================
  Coverage   99.14%   99.14%           
=======================================
  Files           7        7           
  Lines         931      933    +2     
=======================================
+ Hits          923      925    +2     
  Misses          8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds support for zigpy’s TransmitOptions.APS_Encryption by mapping it to deCONZ’s SECURITY_ENABLED transmit option when sending packets that require APS-layer encryption, while ensuring the network-key security option is not set at the same time (since APS security uses the link key).

Changes:

• Update send_packet() to select SECURITY_ENABLED when APS_Encryption is requested, otherwise default to USE_NWK_KEY_SECURITY.
• Add a unit test validating the tx_options mapping for APS encryption.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
zigpy_deconz/zigbee/application.py	Conditionally maps zigpy’s APS encryption transmit option to the correct deCONZ TX flags.
tests/test_send_receive.py	Adds coverage to ensure APS encryption results in SECURITY_ENABLED (and not USE_NWK_KEY_SECURITY) while preserving APS ACK behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.