Fix Bambu TLS: relax hostname/IP verification, keep chain trust enforced

Real hardware surfaced this: H2C failed with 'IP address mismatch', not a
chain-of-trust error like P1P's 'self-signed certificate'. Bambu printer
certs don't carry their DHCP-assigned LAN IP as a SAN, so native-tls's
default hostname check will never pass against a real printer.

Added danger_accept_invalid_hostnames(true) unconditionally in
build_connector() — this only skips the SAN/IP match, it's independent from
danger_accept_invalid_certs (chain trust), which stays fully enforced for
BundledCa/Custom. Verified both directions against local test servers, not
just compiled:
- a cert signed by a trusted CA, with a SAN that does NOT match the
  connecting IP, now verifies OK (previously failed exactly like H2C did)
- a cert signed by an UNTRUSTED CA still correctly fails verification,
  confirming this change didn't weaken chain-of-trust checking

src/printer/bambu.rs

@@ -56,6 +56,16 @@ impl BambuTls {
     fn build_connector(&self) -> anyhow::Result<native_tls::TlsConnector> {
         let mut builder = native_tls::TlsConnector::builder();
 
+        // Bambu printer certificates don't carry their LAN IP as a Subject
+        // Alternative Name — it's DHCP-assigned, so baking it in at
+        // manufacture time wouldn't make sense. Hostname verification has
+        // to be off regardless of trust mode: what matters is whether the
+        // certificate chains to a CA we trust, not whether its SAN matches
+        // the specific IP we happened to dial today. Chain verification
+        // itself stays fully enforced below for BundledCa/Custom — this
+        // narrows *what* gets checked, it doesn't turn checking off.
+        builder.danger_accept_invalid_hostnames(true);
+
         if matches!(self, BambuTls::Insecure) {
             builder.danger_accept_invalid_certs(true);
         } else {