Add printers.toml (gitignored) + real TLS cert test against actual hardware

New:
- printers.example.toml (committed template) / printers.toml (gitignored,
  real hosts + access codes don't belong in git) — a list of real printers
  with vendor, host, access_code/api_key/com_port, and an optional
  per-printer CA override.
- src/fleet.rs loads that file into ready-to-use PrinterHandles, matching
  vendor strings to the right constructor.
- BambuPrinter::test_tls_handshake() does a real (blocking, one-shot) TLS
  handshake to port 8883 using that printer's configured BambuTls trust
  mode — no MQTT protocol, just 'does the certificate verify'. Added
  native-tls and toml as direct dependencies for this.
- examples/test_bambu_certs.rs loads printers.toml and runs the handshake
  test against every Bambu entry.

Also fixes a real bug found while testing against unreachable IPs: plain
TcpStream::connect has no timeout and hung indefinitely on an offline
printer — switched to connect_timeout (5s).

Verified with cargo check --all-targets (0 errors) and by actually running
test_bambu_certs against a local printers.toml (correctly errored on a
missing cert file, then correctly timed out against unreachable test IPs
instead of hanging).

printers.example.toml

@@ -0,0 +1,35 @@
+# Copy this file to printers.toml (gitignored) and fill in your real
+# printers. See src/fleet.rs for the loader, examples/test_bambu_certs.rs
+# for a way to test a Bambu printer's certificate against this config.
+
+[[printer]]
+id = "p1p"
+name = "P1P"
+vendor = "bambu_v1"                    # bambu_v1 | bambu_v2 | prusa_link | prusa_serial | klipper
+host = "192.168.1.50"
+access_code = "REPLACE_WITH_ACCESS_CODE"
+# P1P doesn't chain to the bundled CA — point this at a cert you've
+# downloaded from the printer itself. Leave unset to use the bundled CA.
+ca_cert_path = "./certs/p1p.pem"
+
+[[printer]]
+id = "h2c"
+name = "H2C"
+vendor = "bambu_v2"
+host = "192.168.1.51"
+access_code = "REPLACE_WITH_ACCESS_CODE"
+# No ca_cert_path — current-generation printers verify against the bundled
+# CA (certs/bambu_ca2.pem) fine.
+
+# [[printer]]
+# id = "voron"
+# name = "Voron 2.4"
+# vendor = "klipper"
+# host = "192.168.1.52"
+
+# [[printer]]
+# id = "mk4"
+# name = "MK4"
+# vendor = "prusa_link"
+# host = "192.168.1.53"
+# api_key = "REPLACE_WITH_API_KEY"