feat: aci-sim query helper + onboarding fixes (v0.17.0)

Clean-room README test found a newcomer hits failures in the first 5 min —
all doc/script, not sim bugs. Fixes:
- scripts/run.sh: use ./.venv/bin/python (was bare `python` → ModuleNotFoundError:
  uvicorn unless the venv was activated; now matches sandbox-up.sh).
- NEW `aci-sim query CLASS [--dn/--host/--json]`: stdlib aaaLogin→cookie→query
  helper so newcomers don't hand-roll auth cookies (the old README smoke test
  `curl class/fabricNode.json` had no auth → returned an APIC error envelope).
- README: 60-second quickstart + embedded topology screenshot (docs/images/
  topology.png), port-mode leads with `aci-sim run`, smoke test uses `aci-sim
  query`, install notes git+https is package-only.

900 tests pass (+12 for aci-sim query).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/run.sh

@@ -4,7 +4,9 @@
 # unchanged.
 set -euo pipefail
 cd "$(dirname "$0")/.."
+PY="./.venv/bin/python"
+[ -x "$PY" ] || PY="python3"
 if [ ! -f certs/sim.crt ] || [ ! -f certs/sim.key ]; then
   bash scripts/gen_certs.sh
 fi
-python -m aci_sim.runtime.supervisor
+"$PY" -m aci_sim.runtime.supervisor