Bambu CA trust is per-printer, not per-fleet — P1P needs its own cert

Checked BambuStudio's resources/cert/ directly: it ships exactly one
LAN-mode CA (the bundled bambu_ca2.pem) plus an unrelated cloud-API leaf
cert — no second file to bundle for P1P. So a P1P's certificate is a
genuine per-device case, same as older units' 'download it from the
printer' flow, and a single Config-wide override path can't express 'most
printers use the bundled CA, but this one doesn't'.

Config.bambu_ca_cert_path (Option<PathBuf>) -> bambu_ca_cert_overrides
(HashMap<printer_id, PathBuf>), parsed from a comma-separated
CONTINUUM_BAMBU_CA_CERT_OVERRIDES env var. BambuTls::from_config renamed
to ::resolve to make clear it's called once per printer with that
printer's own override, not once for the whole config.

Verified with cargo check --all-targets and a full run of
cargo run --example printer_polymorphism.

.env.example

@@ -10,4 +10,11 @@ CONTINUUM_UPLINK_URL=wss://api.continuum.local/ws/edge/v1
 CONTINUUM_GO2RTC_BIN=/usr/local/bin/go2rtc
 CONTINUUM_GO2RTC_CONFIG=./go2rtc.yaml
 
+# Bambu MQTTS certificate trust. Most printers verify fine against the
+# bundled shared CA (certs/bambu_ca2.pem) and need nothing here. For a
+# printer that doesn't chain to it (P1P, at least), add "printer_id=path"
+# entries, comma-separated: CONTINUUM_BAMBU_CA_CERT_OVERRIDES=p1=./certs/p1p.pem
+CONTINUUM_BAMBU_CA_CERT_OVERRIDES=
+CONTINUUM_BAMBU_REQUIRE_VALID_CERT=true
+
 RUST_LOG=info,continuum_proxy=debug