feat: aci-sim query helper + onboarding fixes (v0.17.0)

Clean-room README test found a newcomer hits failures in the first 5 min —
all doc/script, not sim bugs. Fixes:
- scripts/run.sh: use ./.venv/bin/python (was bare `python` → ModuleNotFoundError:
  uvicorn unless the venv was activated; now matches sandbox-up.sh).
- NEW `aci-sim query CLASS [--dn/--host/--json]`: stdlib aaaLogin→cookie→query
  helper so newcomers don't hand-roll auth cookies (the old README smoke test
  `curl class/fabricNode.json` had no auth → returned an APIC error envelope).
- README: 60-second quickstart + embedded topology screenshot (docs/images/
  topology.png), port-mode leads with `aci-sim run`, smoke test uses `aci-sim
  query`, install notes git+https is package-only.

900 tests pass (+12 for aci-sim query).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -20,7 +20,7 @@ pip install -e '.[dev]'          # installs aci_sim + fastapi/uvicorn/pydantic/p
 .venv/bin/python -m pytest -q
 ```
 
-The suite currently has **888 tests** and must stay green. If you add a
+The suite currently has **900 tests** and must stay green. If you add a
 feature or fix a bug, add or extend tests under `tests/` in the same PR —
 most existing tests are organized by PR/feature (`tests/test_pr*.py`,
 `tests/test_<feature>.py`); follow that convention for new ones.