docs: mark expand-device-support branch ready for merge

Updates TODO.md to reflect the verification pass outcome:
- pixel_reduce extraction marked done (commit cc87fba)
- pre-merge verification pass marked complete: 1358 pytest tests pass,
  ruff and black clean (against pre-commit-pinned 24.10.0),
  npx tsc --noEmit clean, bundle compiles
- Mi-Light / MiBoxer explicitly marked WONTDO with rationale
  (esp8266_milight_hub firmware -> existing MQTT target is the better
  path for modern Mi-Light deployments)
- duplicate Nanoleaf bullet removed; Twinkly noted as deferred

No code changes -- this is purely a checkpoint for the merge review.

TODO.md

@@ -756,9 +756,13 @@ After phase 1 the codebase will have 3 fresh examples of "ping the LAN, listen f
       handshake (200/403/500/missing-token/transport-error), state
       mutations, brightness clamping, Device.to_config round-trip
       including encrypted-token roundtrip.
-- [ ] Twinkly
+- [ ] Twinkly — multi-pixel + login flow; deferred
-- [ ] Nanoleaf OpenAPI
+- [WONTDO] Mi-Light / MiBoxer UDP gateway — the recommended path for
-- [ ] Mi-Light / MiBoxer UDP gateway
+  modern Mi-Light deployments is `esp8266_milight_hub` firmware → MQTT,
+  which LedGrab already supports through the existing MQTT device target
+  (commit `530316c`). Native V6 driver would be ~400 lines + finicky
+  session protocol + custom 1-byte hue table; the marginal benefit over
+  the MQTT path is small. Revisit if a user complaint surfaces.
 
 ### Phase 5 — Open pixel protocols (cheap completionism)
 
@@ -778,3 +782,15 @@ After phase 1 the codebase will have 3 fresh examples of "ping the LAN, listen f
 
 - [ ] Generic HID-ambient framework + VID/PID registry
 - [ ] First reverse-engineered target (probably Govee Immersion / DreamView)
+
+### Cleanup + verification
+
+- [x] **`_average_color` extraction** (commit `cc87fba`). Six identical
+      copies (Yeelight / WiZ / LIFX / Govee / Nanoleaf / BLE) collapsed
+      into `core/devices/pixel_reduce.average_color`. Net -76 lines.
+      Hue is out by design — its Entertainment API addresses up to seven
+      lights individually.
+- [x] **Pre-merge verification pass.** 1358 pytest tests pass; ruff
+      clean across all device modules and tests; black clean against
+      the pre-commit-pinned 24.10.0; `npx tsc --noEmit` clean; bundle
+      compiles. No issues surfaced — branch is in shape to merge.