Execute start_print, and never await it on the uplink task

The gateway can now run a cloud-dispatched print: download the job file from
the presigned URL in the command, then hand it to the existing
`upload_project_file`, which derives the filament mapping from the archive,
transfers it over FTPS and starts it.

## The download refuses to be a weapon

`src/uplink/download.rs` checks the HTTP status before reading a byte,
because an expired presigned URL answers 403 with an XML error document and
writing *that* to a printer as a project is the worst outcome available. It
rejects a `Content-Length` over 256 MiB before reading, and enforces the cap
while streaming as well, so a server that lies or omits the length cannot
make a small gateway box buffer until the OOM killer arrives. A byte count
that disagrees with `Content-Length` is an error: a `.3mf` is a zip, and a
truncated one loses the central directory the printer needs. HTTPS only, no
redirects, and the URL is stripped from error messages.

`PrinterCommand` no longer derives `Debug` for the same reason - `dispatch`
logs every command, and a presigned URL is a bearer credential until it
expires. It prints as `<redacted>`.

## Why it is spawned

`start_print` is the one command that cannot be answered inline, and the
reason is not latency. Everything else here is an MQTT publish returning in
milliseconds. This downloads tens of megabytes and then transfers them at a
measured 0.2 MiB/s - about four minutes for a 50 MB project - and awaiting
that inside the uplink's `select!` loop stops heartbeats and, far worse,
stops telemetry for the duration.

No telemetry is what makes spawning mandatory rather than tidy. The cloud now
derives a job's state from the telemetry that follows a start, so a gateway
that goes silent for four minutes during every job start withholds exactly
the information the job depends on - while the backend times the command out
after ten seconds and concludes the start failed. The job would be requeued
onto a printer that was busy printing it.

So the `ok` means "accepted, working on it", which is all a start reply was
ever trusted to mean. `runs_for_minutes` is an exhaustive match rather than a
`matches!`, so a new variant has to make that choice instead of defaulting to
the stall.

The gap this leaves is honest and recorded in the code: a failure after the
ack has no `CommandResult` to travel on, because answering later needs an
outbound channel this loop does not have. Until it does, the gateway's log is
where the reason lives and the backend reaps the job.

reqwest 0.12 with `rustls-tls-native-roots`, not 0.13: 0.13 pulls
`webpki-root-certs` under CDLA-Permissive-2.0, which is not on the allow
list, and `aws-lc` brings OpenSSL-licensed C. `cargo deny check licenses`
passes. 54 tests.

src/uplink/protocol.rs

@@ -118,14 +118,10 @@ pub enum ServerMessage {
 
 /// The closed set of things the cloud is allowed to ask a printer to do.
 ///
-/// Deliberately small, and deliberately missing the obvious one: there is no
-/// "start a print" variant. `BambuPrinter::start_uploaded_file` has now been
-/// confirmed by hand on a real P1P (2026-10-11), so the original reason for
-/// leaving it out - never having been run against hardware - is spent. What
-/// is still missing is the path around it: nothing uploads a sliced file to a
-/// gateway, and nothing decides which printer should run which job. A start
-/// variant belongs here once there is something to start.
-#[derive(Debug, Clone, Deserialize)]
+/// Deliberately small. `StartPrint` is the newest and the only one that
+/// reaches outside the gateway (it fetches a URL), so it is the one with
+/// bounds on it - see `download.rs`.
+#[derive(Clone, Deserialize)]
 #[serde(tag = "action", rename_all = "snake_case")]
 pub enum PrinterCommand {
     /// 0-100. Each vendor converts to whatever its own mechanism wants (for
@@ -145,4 +141,63 @@ pub enum PrinterCommand {
     /// stop during `PREPARE`/`RUNNING` moves the printer to `FAILED`, which
     /// is how Bambu reports an operator-cancelled print.
     ControlPrint { control: PrintControl },
+    /// Download a job's file, put it on the printer and start it.
+    ///
+    /// A successful result means the gateway *accepted* the job, not that
+    /// anything is printing: a real run on a P1P was accepted, uploaded
+    /// byte-perfect, reached RUNNING, then paused itself on a filament
+    /// fault. Job state must follow the telemetry, never this reply.
+    ///
+    /// There is no AMS or filament field on purpose. The mapping is read out
+    /// of the archive's own `Metadata/slice_info.config` by
+    /// `upload_project_file`, because only the archive knows what each plate
+    /// was sliced for - guessing it is what heated a P1P to 250C and paused
+    /// it at 1%.
+    ///
+    /// `url` is a presigned, expiring GET, minted at dispatch time (a queued
+    /// job may wait days). It is a URL and not the bytes so the file stays
+    /// off the JSON control channel and object-store credentials stay out of
+    /// every gateway. It is a bearer credential, which is why `Debug` below
+    /// hides it. `file_name` is what the file is called on the printer;
+    /// `.3mf` is treated as a sliced project, anything else as bare gcode.
+    /// `job_id` is only for lining gateway logs up against a cloud job.
+    StartPrint { job_id: String, file_name: String, url: String },
+}
+
+impl PrinterCommand {
+    /// Whether this command takes long enough that it must not be awaited on
+    /// the uplink's own task.
+    ///
+    /// The threshold is not arbitrary: everything but `StartPrint` is a single
+    /// MQTT publish, while `StartPrint` downloads a project and then transfers
+    /// it to a printer at a measured 0.2 MiB/s - minutes, during which the
+    /// uplink would send no telemetry at all. See `spawn_long_command`.
+    pub fn runs_for_minutes(&self) -> bool {
+        // Written as an exhaustive match rather than `matches!`, so a new
+        // variant has to make this decision rather than defaulting to
+        // "answer it inline" and quietly reintroducing the stall.
+        match self {
+            Self::StartPrint { .. } => true,
+            Self::SetFanSpeed { .. } | Self::SendGcodeLine { .. } | Self::ControlPrint { .. } => false,
+        }
+    }
+}
+
+/// Hand-written so the presigned `url` never reaches a log line: `dispatch`
+/// logs every command with `{:?}`, and the query string of that URL is
+/// enough to download the job file until it expires.
+impl std::fmt::Debug for PrinterCommand {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::SetFanSpeed { percent } => f.debug_struct("SetFanSpeed").field("percent", percent).finish(),
+            Self::SendGcodeLine { line } => f.debug_struct("SendGcodeLine").field("line", line).finish(),
+            Self::ControlPrint { control } => f.debug_struct("ControlPrint").field("control", control).finish(),
+            Self::StartPrint { job_id, file_name, .. } => f
+                .debug_struct("StartPrint")
+                .field("job_id", job_id)
+                .field("file_name", file_name)
+                .field("url", &"<redacted>")
+                .finish(),
+        }
+    }
 }