docs: fix two SPEC.md errors (HTTP method, error code 408)

- DSM API uses POST with application/x-www-form-urlencoded, not GET
- Error 408 means "non-supported additional field", not "device token required"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SPEC.md

@@ -48,7 +48,7 @@ CLI (click)
 
 ## DSM API Endpoints
 
-All requests use `GET /webapi/entry.cgi` with query parameters unless noted.
+All requests use `POST /webapi/entry.cgi` with `application/x-www-form-urlencoded` body unless noted.
 
 | API | Version | Methods used |
 |-----|---------|--------------|
@@ -466,7 +466,7 @@ pagination hint when more results are available.
 | 401 | Guest or disabled account | "DSM account is disabled." |
 | 403 | 2FA required | "Two-factor authentication required — run setup." |
 | 404 | 2FA failed | "OTP code incorrect." |
-| 408 | Device token required | "Device token required — run setup again." |
+| 408 | Non-supported additional field | "DSM rejected additional fields — check parameter format." |
 | 599 | Background service not ready | (handled by `_start_and_poll_oneshot` — restart task) |
 | 1800 | File not found | "File or folder not found: {path}" |
 | 1801 | No write permission | "No write permission for: {path}" |