Add BambuGenericPrinter::ensure_trusted() — smooth auto-connect, SSH-style

The manual fetch_bambu_cert workflow works but needs two commands and a
printers.toml edit. ensure_trusted() collapses that into one call, using
the same trust model SSH uses for host keys:
- a pin already on disk (certs/pinned/<id>.pem) is used directly, no new
  trust decision is made on every run
- no pin yet + bundled CA verifies fine (current-gen printers): nothing to
  do
- no pin yet + bundled CA fails (P1P, etc.): auto-pins via
  trust-on-first-connect, same as fetch_bambu_cert, but automatic
- an *explicit* pin (you set ca_cert_path yourself) never gets silently
  auto-pinned over — a failure there is a real error

examples/auto_connect_bambu.rs demonstrates the one-command flow.

Verified all three states against local test servers, not just compiled:
first run with no pin auto-pins and connects; second run against the same
server is silent (no re-TOFU message) and just verifies against the pin;
third run after swapping the server's certificate correctly FAILS instead
of silently re-pinning — confirms the security property survives the
smoother UX.

examples/auto_connect_bambu.rs

@@ -0,0 +1,34 @@
+//! Run with: cargo run --example auto_connect_bambu
+//!
+//! The "smooth, no manual steps" version of test_bambu_certs +
+//! fetch_bambu_cert combined: for each Bambu printer in printers.toml,
+//! makes sure it has a working certificate, auto-pinning one via
+//! trust-on-first-connect if the bundled CA doesn't verify. Safe to run
+//! repeatedly — a printer that's already pinned (certs/pinned/<id>.pem)
+//! just gets re-verified against its pin, no network trust decision is
+//! made again.
+
+use continuum_proxy::fleet;
+use continuum_proxy::printer::PrinterHandle;
+
+fn main() -> anyhow::Result<()> {
+    let mut printers = fleet::load(std::path::Path::new("printers.toml"))?;
+    let cert_dir = std::path::Path::new("certs/pinned");
+
+    for printer in &mut printers {
+        match printer {
+            PrinterHandle::BambuV1(bambu) => report(&bambu.ensure_trusted(cert_dir)),
+            PrinterHandle::BambuV2(bambu) => report(&bambu.ensure_trusted(cert_dir)),
+            _ => {}
+        }
+    }
+
+    Ok(())
+}
+
+fn report(result: &anyhow::Result<()>) {
+    match result {
+        Ok(()) => println!("connected"),
+        Err(err) => println!("failed: {err}"),
+    }
+}