Support direct SBH battery registers via WiNet-S forwarded Unit ID on SHxxT inverters

[CaneTLOTW]

Context

This is about the newer Sungrow SHxxT hybrid inverters together with SBH
batteries, not the older SHxRT/SBR use case.

Tested installation:

• Inverter: SH20T
• Battery: SBH150-V11
• Connection: WiNet-S over LAN, Modbus TCP port 502
• Function code: 04 / Read Input Registers
• Inverter TCP Unit ID: 1
• Battery internal COM1 device address shown in WiNet-S: 200
• Battery forwarded Modbus TCP Unit ID shown in WiNet-S: 2

The important finding is that the battery is reachable through WiNet-S, but not
by using TCP Unit ID 200. The WiNet-S device list exposes the SBH battery
through the configured forwarded Modbus ID, in this case TCP Unit ID 2.

So the practical mapping is:

TCP Unit ID 1 -> internal COM1 address 1   -> SH20T
TCP Unit ID 2 -> internal COM1 address 200 -> SBH150-V11

This differs from the current SBR-oriented assumption in the template/secrets
comments, where sungrow_modbus_sbr_device_address: 200 is described as not
available via WiNet-S.

Confirmed direct SBH registers

The following registers were read successfully from the SBH using:

Connection: WiNet-S TCP endpoint
Unit ID: 2
Function: FC04

Address	Count	Type	Scale	Meaning	Notes
10710	10	string	1	SBH battery serial number	Big-endian ASCII, no byte/word swap
10720	10	string	1	SBH BCU firmware	Big-endian ASCII, no byte/word swap
10735	5	raw block	1	undocumented metadata block	valid as block, not all addresses are valid as single reads
10740	1	uint16	0.1	battery voltage	V
10741	1	int16	0.1	battery current	A; sign should be preserved
10742	1	uint16	0.1	battery temperature	C
10743	1	uint16	0.1	direct BMS SOC	%
10744	1	uint16	1	SOH	%
10745	2	uint32, word swap	0.1	total charge energy	kWh
10747	2	uint32, word swap	0.1	total discharge energy	kWh
10749	1	uint16	1	undocumented diagnostic value	observed stable as 1
10750	1	uint16	1	undocumented diagnostic value	observed stable as 14
19938	1	uint16	0.1	inferred BMS current limit	observed 500 -> 50.0 A

Confirmed example values:

10710 -> S2407105557
10720 -> SBHBCU-S_22011.04.02
10745 raw [38379, 0] -> word swap -> 3837.9 kWh
10747 raw [36391, 0] -> word swap -> 3639.1 kWh
19938 raw 500 -> 50.0 A

19938 = 50.0 A correlated with the inverter-side BMS max current registers:

Unit ID 1 / FC04 / 5634 = BMS maximum charging current
Unit ID 1 / FC04 / 5635 = BMS maximum discharging current

The exact SBH meaning of 19938 is not officially confirmed, so a neutral name
such as SBH BMS Current Limit would be safer than separate charge/discharge
naming.

Important correction for 10720

For this SBH150, address 10720, count 10, is not a battery status array. It
is the BCU firmware string:

SBHBCU-S_22011.04.02

This is analogous to community SBR examples where manufacturer registers
10721-10730 contain the battery firmware string.

What should not be enabled for SBH150

The SBR per-cell/per-module diagnostics from 10756 onward did not work on
this SBH150-V11. They returned Modbus Exception 2 / Illegal Data Address.

Examples that should not be polled for this SBH model:

10756-10788
10821 ff. module serial ranges

These appear to be SBR-specific and should not be blindly reused for SBH.

Suggested implementation direction

Add an SBH-specific battery register group/template separate from the existing
SBR battery diagnostics.

Suggested configuration idea:

sungrow_modbus_sbh_device_address: 2

Documentation should clarify that for WiNet-S the correct TCP Unit ID is the
forwarded Modbus ID shown in the WiNet-S device list, not necessarily the
internal COM1 address.

Example wording:

For SHxxT + SBH through WiNet-S, check the WiNet-S device list.
Use the forwarded Modbus TCP Unit ID for the SBH battery.
Example: internal SBH address 200, forwarded TCP Unit ID 2.

Why this matters

This makes direct SBH diagnostics available for newer SHxxT installations
without requiring a separate RS485 adapter. It also avoids repeatedly polling
SBR-only registers that are invalid for SBH and produce Modbus exceptions.

Scope request

Please consider adding:

• SHxxT/SBH-specific documentation for WiNet-S forwarded Unit IDs
• a separate SBH register set for 10710, 10720, 10735-10750, and 19938
• explicit note that SBR cell/module diagnostics are not confirmed for SBH and
  returned Exception 2 on SBH150-V11
• no write registers for SBH in the first step

I can provide the local Home Assistant YAML implementation and
CSV/JSON/Markdown test results if useful.