The add and remove buttons, and the read that checks them

Anker documents neither rfid write, so the bodies are inferred from the
field names get_device_cards answers with, and every write re-reads the
list: what the card shows is what the account holds, never what an
undocumented endpoint claimed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Web App/web/src/api.js

@@ -335,6 +335,22 @@ export const api = {
   getAnkerChargerDetails: (sn) =>
     request(`/integrations/anker-solix/chargers/${encodeURIComponent(sn)}/details`),
 
+  // The RFID cards on one charger — the only calls in this client that change
+  // anything on the Anker account. Anker documents neither endpoint, so the
+  // server infers the request and then reads the list back: both of these answer
+  // with {present, cards}, and it is the list that says what happened, not the
+  // status code.
+  saveAnkerRfidCard: (sn, cardNumber, cardName) =>
+    request(`/integrations/anker-solix/chargers/${encodeURIComponent(sn)}/rfid-cards`, {
+      method: "POST",
+      body: JSON.stringify({ cardNumber, cardName }),
+    }),
+  deleteAnkerRfidCard: (sn, cardNumber) =>
+    request(
+      `/integrations/anker-solix/chargers/${encodeURIComponent(sn)}/rfid-cards/${encodeURIComponent(cardNumber)}`,
+      { method: "DELETE" }
+    ),
+
   // Anker Solix control (per charger), over whichever transport the user's
   // control mode selects. getAnkerControl returns the control mode, connection
   // status, and a live status snapshot — an OCPP session snapshot in own/proxy