Bambu TLS trust config + finish PrusaLink/PrusaSerial split

Certs:
- Vendor Bambu's shared LAN-mode root CA (certs/bambu_ca2.pem, verified
  self-signed CA:TRUE, see certs/README.md for provenance/fingerprint).
- Config gains bambu_ca_cert_path (per-printer override) and
  bambu_require_valid_cert (the allow/reject flag); printer::bambu::BambuTls
  turns those into BundledCa/Custom/Insecure. connect() doesn't perform a
  real handshake yet (no TLS-capable MQTT client wired in), just reports
  which trust mode it would use.

Also reconciles a rename in flight (Printer -> GenericPrinter trait) and
finishes the PrusaPrinter -> PrusaLinkPrinter/PrusaSerialPrinter split:
added the missing GenericPrinter impl for PrusaSerialPrinter, fixed
PrinterHandle's variant payload types, updated mod.rs's pub use list and
doc comments, and updated the example to the new 5-variant shape.

Verified with cargo check --all-targets (0 errors) and a full run of
cargo run --example printer_polymorphism.

src/config.rs

@@ -1,4 +1,5 @@
 use std::env;
+use std::path::PathBuf;
 
 #[derive(Debug, Clone)]
 pub struct Config {
@@ -8,6 +9,16 @@ pub struct Config {
     pub uplink_url: String,
     pub go2rtc_bin: String,
     pub go2rtc_config: String,
+
+    /// Overrides the bundled Bambu root CA (see `certs/bambu_ca2.pem`) with
+    /// a specific certificate file — for a printer whose firmware doesn't
+    /// chain to that shared CA. Most setups leave this unset.
+    pub bambu_ca_cert_path: Option<PathBuf>,
+    /// When `false`, Bambu MQTTS connections skip certificate verification
+    /// entirely instead of checking against the CA above. `true` (the
+    /// default) is the secure choice; only flip this for a printer whose
+    /// certificate you can't get to verify any other way.
+    pub bambu_require_valid_cert: bool,
 }
 
 impl Config {
@@ -19,6 +30,9 @@ impl Config {
             uplink_url: env_or("CONTINUUM_UPLINK_URL", "wss://api.continuum.local/ws/edge/v1"),
             go2rtc_bin: env_or("CONTINUUM_GO2RTC_BIN", "go2rtc"),
             go2rtc_config: env_or("CONTINUUM_GO2RTC_CONFIG", "./go2rtc.yaml"),
+
+            bambu_ca_cert_path: env::var("CONTINUUM_BAMBU_CA_CERT_PATH").ok().map(PathBuf::from),
+            bambu_require_valid_cert: env_or("CONTINUUM_BAMBU_REQUIRE_VALID_CERT", "true") == "true",
         })
     }
 }