API surface discovered from the official web app not yet wrapped

Captured by driving the official web app (app.evnex.io) with network recording, alongside the endpoints the library already wraps. Response shapes verified against a live account.

## Unwrapped endpoints

- `GET /v2/apps/organisations/{org}/locations` — org locations with address, coordinates, ICP number/retailer/distributor details, timezone, and (via `included`) full charge point objects. A natural `get_org_locations()` + schema.
- `GET /organisations/{org}/summary/status` — connector-state counts (`available/charging/disabled/faulted/occupied/offline/reserved`) under `data.attributes.connectors`. Note the library currently wraps the older `/v2/apps/...` variant with a flat shape; the app uses this newer one.
- `GET /v2/apps/organisations/{org}/tokens` — RFID/charge tokens (403 on a Free-tier org, so schema unknown; likely paid orgs only).

## App-only commands observed (not captured, not invoked)

The charge point page exposes Charge / Unlock / Disable / **Reload charge point** buttons. Unlock/availability are already wrapped; "reload" (reboot) is not — likely `POST /charge-points/{id}/commands/...`. Worth capturing the exact command name before wrapping.

## Also noted

- The app authenticates with a different Cognito app client id than the library's; both work against the same API.
- An unauthenticated `cognito-identity` federated call fails 400 and is retried silently by the app — not needed for API access.

Start by reading the existing organization location and status wrappers and their schemas, then compare them with the captured routes and live response shapes described here. Verify the paid-tier token response before handling it, and capture the reload command separately; done means the confirmed endpoints and schemas are wrapped without guessing the unobserved command.

Written by the indexing model from the issue text.