Split BambuPrinter into BambuGenericPrinter -> BambuV1Printer/BambuV2Printer

Completes the GenericPrinter -> BambuGenericPrinter -> BambuV1/V2 chain this
project wanted from the start. BambuGenericPrinter holds the fields and
behavior every Bambu printer shares (access code, serial number, CA trust,
the TLS test/fetch methods); BambuV1Printer and BambuV2Printer each *have*
one (composition) and are now genuinely separate types, ready to carry
flavour-specific report-schema fields later. Also threads through a new
'sn' (serial number) field the real MQTT topics will need.

Adds real 'fetch the CA automatically' capability, verified against a live
TLS server (not just compiled):
- BambuGenericPrinter::fetch_certificate() does trust-on-first-connect —
  connects once with verification disabled, captures the certificate the
  printer actually presents via native_tls's peer_certificate()/to_der(),
  and returns it as PEM. Deliberately a method you call once by hand
  (examples/fetch_bambu_cert.rs), not something connect() falls back to
  silently, since TOFU trusts whoever's on the network the moment you run
  it. Verified end-to-end against a local openssl s_server: the fetched
  PEM's SHA-256 fingerprint exactly matched the server's real certificate.
- Verified the other direction too: test_bambu_certs (bundled-CA mode)
  correctly REJECTS that same test server's cert, since it wasn't signed
  by the real Bambu CA.

Splitting BambuV1Printer/BambuV2Printer into distinct types broke the
PrinterHandle::BambuV1(x) | PrinterHandle::BambuV2(x) or-pattern in both
examples (or-patterns require every alternative to bind the same type) —
fixed by giving each variant its own match arm.

printers.example.toml

@@ -8,8 +8,11 @@ name = "P1P"
 vendor = "bambu_v1"                    # bambu_v1 | bambu_v2 | prusa_link | prusa_serial | klipper
 host = "192.168.1.50"
 access_code = "REPLACE_WITH_ACCESS_CODE"
+sn = "REPLACE_WITH_SERIAL_NUMBER"      # printer screen > Settings > Device (used for MQTT topics later)
 # P1P doesn't chain to the bundled CA — point this at a cert you've
 # downloaded from the printer itself. Leave unset to use the bundled CA.
+# `cargo run --example fetch_bambu_cert -- p1p ./certs/p1p.pem` can fetch it
+# for you (trust-on-first-connect — see that example's doc comment).
 ca_cert_path = "./certs/p1p.pem"
 
 [[printer]]
@@ -18,6 +21,7 @@ name = "H2C"
 vendor = "bambu_v2"
 host = "192.168.1.51"
 access_code = "REPLACE_WITH_ACCESS_CODE"
+sn = "REPLACE_WITH_SERIAL_NUMBER"
 # No ca_cert_path — current-generation printers verify against the bundled
 # CA (certs/bambu_ca2.pem) fine.