Bambu CA trust is per-printer, not per-fleet — P1P needs its own cert

Checked BambuStudio's resources/cert/ directly: it ships exactly one
LAN-mode CA (the bundled bambu_ca2.pem) plus an unrelated cloud-API leaf
cert — no second file to bundle for P1P. So a P1P's certificate is a
genuine per-device case, same as older units' 'download it from the
printer' flow, and a single Config-wide override path can't express 'most
printers use the bundled CA, but this one doesn't'.

Config.bambu_ca_cert_path (Option<PathBuf>) -> bambu_ca_cert_overrides
(HashMap<printer_id, PathBuf>), parsed from a comma-separated
CONTINUUM_BAMBU_CA_CERT_OVERRIDES env var. BambuTls::from_config renamed
to ::resolve to make clear it's called once per printer with that
printer's own override, not once for the whole config.

Verified with cargo check --all-targets and a full run of
cargo run --example printer_polymorphism.

src/printer/bambu.rs

@@ -24,10 +24,13 @@ pub enum BambuTls {
 }
 
 impl BambuTls {
-    /// Turns `Config`'s two raw settings into one of the three states
-    /// above. `require_valid_cert = false` always means `Insecure`,
-    /// regardless of whether a custom cert path was also given.
-    pub fn from_config(cert_path: Option<&Path>, require_valid_cert: bool) -> anyhow::Result<Self> {
+    /// Resolves the trust mode for *one* printer. Call this per printer,
+    /// passing `config.bambu_ca_cert_overrides.get(printer_id)` — there's
+    /// no single override for the whole fleet, because not every Bambu
+    /// model chains to the same CA (P1P doesn't). `require_valid_cert =
+    /// false` always means `Insecure`, regardless of whether that printer
+    /// also has an override entry.
+    pub fn resolve(cert_path: Option<&Path>, require_valid_cert: bool) -> anyhow::Result<Self> {
         if !require_valid_cert {
             return Ok(BambuTls::Insecure);
         }