Bambu CA trust is per-printer, not per-fleet — P1P needs its own cert

Checked BambuStudio's resources/cert/ directly: it ships exactly one
LAN-mode CA (the bundled bambu_ca2.pem) plus an unrelated cloud-API leaf
cert — no second file to bundle for P1P. So a P1P's certificate is a
genuine per-device case, same as older units' 'download it from the
printer' flow, and a single Config-wide override path can't express 'most
printers use the bundled CA, but this one doesn't'.

Config.bambu_ca_cert_path (Option<PathBuf>) -> bambu_ca_cert_overrides
(HashMap<printer_id, PathBuf>), parsed from a comma-separated
CONTINUUM_BAMBU_CA_CERT_OVERRIDES env var. BambuTls::from_config renamed
to ::resolve to make clear it's called once per printer with that
printer's own override, not once for the whole config.

Verified with cargo check --all-targets and a full run of
cargo run --example printer_polymorphism.

certs/README.md

@@ -14,10 +14,16 @@ instead of fetching/pinning a certificate per printer.
   `Basic Constraints: CA:TRUE`, `Key Usage: Certificate Sign, CRL Sign` — a
   genuine root CA, not a per-device leaf certificate. Valid until 2050.
 
-The "CA2" name implies there was a CA1 generation before it — some
-older printers/firmware may not chain to this root and need their own
-certificate instead. `CONTINUUM_BAMBU_CA_CERT_PATH` (see `.env.example`)
-overrides this default with a specific file for exactly that case.
+The "CA2" name implies there was a CA1 generation before it, and at least
+one current model — P1P — doesn't chain to this root either: BambuStudio's
+`resources/cert/` only has this one file (plus an unrelated
+`*.bambulab.com` leaf cert for their cloud API), so there's no second
+bundled file to grab for P1P. That means it's a genuine per-device
+certificate, the same "download it from the printer" case as the older
+units. `CONTINUUM_BAMBU_CA_CERT_OVERRIDES` (see `.env.example`) is a
+per-printer-id map for exactly this — there's no single fleet-wide
+override, because different printers can legitimately need different
+certificates at the same time.
 
 If a printer's connection ever fails certificate verification against this
 file, re-fetch from the source URL above (BambuStudio ships whatever the