feat(config_flow): remote-protocol cert/PIN pairing step + reauth after device hard reset (shared .storage cert paths; ADB step body byte-intact, routes onward when protocol enabled)

custom_components/nvidia_shield/helpers.py

@@ -29,6 +29,19 @@ def adb_key_path(hass: HomeAssistant) -> str:
     return os.path.join(hass.config.config_dir, ".storage", DOMAIN, "adbkey")
 
 
+def protocol_cert_paths(hass: HomeAssistant) -> tuple[str, str]:
+    """Local (certfile, keyfile) paths for the remote protocol client.
+
+    Mirrors core androidtv_remote's storage pattern: private material under
+    ``.storage/<domain>/``. Shared between config-flow pairing and runtime —
+    an entry aborts duplicate setup by unique_id (= device MAC), so one pair
+    of files suffices per install.
+    """
+    base = os.path.join(hass.config.config_dir, ".storage", DOMAIN)
+    os.makedirs(base, exist_ok=True)
+    return os.path.join(base, "client.pem"), os.path.join(base, "client.key")
+
+
 def discover_adb_host(
     hass: HomeAssistant, androidtv_entity_id: str | None
 ) -> str | None: