Add printers.toml (gitignored) + real TLS cert test against actual hardware

New:
- printers.example.toml (committed template) / printers.toml (gitignored,
  real hosts + access codes don't belong in git) — a list of real printers
  with vendor, host, access_code/api_key/com_port, and an optional
  per-printer CA override.
- src/fleet.rs loads that file into ready-to-use PrinterHandles, matching
  vendor strings to the right constructor.
- BambuPrinter::test_tls_handshake() does a real (blocking, one-shot) TLS
  handshake to port 8883 using that printer's configured BambuTls trust
  mode — no MQTT protocol, just 'does the certificate verify'. Added
  native-tls and toml as direct dependencies for this.
- examples/test_bambu_certs.rs loads printers.toml and runs the handshake
  test against every Bambu entry.

Also fixes a real bug found while testing against unreachable IPs: plain
TcpStream::connect has no timeout and hung indefinitely on an offline
printer — switched to connect_timeout (5s).

Verified with cargo check --all-targets (0 errors) and by actually running
test_bambu_certs against a local printers.toml (correctly errored on a
missing cert file, then correctly timed out against unreachable test IPs
instead of hanging).

src/fleet.rs

@@ -0,0 +1,84 @@
+//! Loads real printer connection details from a TOML file — see
+//! `printers.example.toml` for the shape. The actual file (`printers.toml`
+//! by default) is gitignored: it holds real hostnames and access codes for
+//! your printers, which don't belong in version control.
+
+use std::path::Path;
+
+use serde::Deserialize;
+
+use crate::printer::{BambuPrinter, BambuTls, KlipperPrinter, PrinterHandle, PrusaLinkPrinter, PrusaSerialPrinter};
+
+#[derive(Debug, Deserialize)]
+struct FleetFile {
+    #[serde(rename = "printer", default)]
+    printers: Vec<PrinterEntry>,
+}
+
+#[derive(Debug, Deserialize)]
+struct PrinterEntry {
+    id: String,
+    name: String,
+    /// One of: "bambu_v1", "bambu_v2", "prusa_link", "prusa_serial", "klipper".
+    vendor: String,
+    host: Option<String>,
+    access_code: Option<String>,
+    api_key: Option<String>,
+    com_port: Option<i16>,
+    /// Path to a printer-specific CA certificate. Leave unset to use the
+    /// bundled Bambu CA — only needed for a printer that doesn't chain to
+    /// it (P1P, at least; see certs/README.md).
+    ca_cert_path: Option<String>,
+    #[serde(default = "default_true")]
+    require_valid_cert: bool,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// Reads and parses a printers file into ready-to-use `PrinterHandle`s.
+pub fn load(path: &Path) -> anyhow::Result<Vec<PrinterHandle>> {
+    let text = std::fs::read_to_string(path).map_err(|err| {
+        anyhow::anyhow!(
+            "failed to read {path:?}: {err} (copy printers.example.toml to printers.toml and fill in your printers)"
+        )
+    })?;
+    let file: FleetFile = toml::from_str(&text)?;
+
+    file.printers.into_iter().map(build_printer).collect()
+}
+
+fn build_printer(entry: PrinterEntry) -> anyhow::Result<PrinterHandle> {
+    match entry.vendor.as_str() {
+        "bambu_v1" | "bambu_v2" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            let access_code = require_field(&entry.id, "access_code", entry.access_code)?;
+            let tls = BambuTls::resolve(entry.ca_cert_path.as_deref().map(Path::new), entry.require_valid_cert)?;
+            let printer = BambuPrinter::new(&entry.id, &entry.name, &host, &access_code, tls);
+            Ok(if entry.vendor == "bambu_v1" {
+                PrinterHandle::BambuV1(printer)
+            } else {
+                PrinterHandle::BambuV2(printer)
+            })
+        }
+        "prusa_link" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            let api_key = require_field(&entry.id, "api_key", entry.api_key)?;
+            Ok(PrinterHandle::PrusaLink(PrusaLinkPrinter::new(&entry.id, &entry.name, &host, &api_key)))
+        }
+        "prusa_serial" => {
+            let com_port = entry.com_port.ok_or_else(|| anyhow::anyhow!("{}: prusa_serial needs com_port", entry.id))?;
+            Ok(PrinterHandle::PrusaSerial(PrusaSerialPrinter::new(&entry.id, &entry.name, com_port)))
+        }
+        "klipper" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            Ok(PrinterHandle::Klipper(KlipperPrinter::new(&entry.id, &entry.name, &host)))
+        }
+        other => Err(anyhow::anyhow!("{}: unknown vendor '{other}'", entry.id)),
+    }
+}
+
+fn require_field(printer_id: &str, field: &str, value: Option<String>) -> anyhow::Result<String> {
+    value.ok_or_else(|| anyhow::anyhow!("{printer_id}: missing required field '{field}'"))
+}

src/lib.rs

@@ -3,4 +3,5 @@
 //! `examples/`) and future integration tests can `use continuum_proxy::...`
 //! without duplicating module declarations.
 
+pub mod fleet;
 pub mod printer;

src/printer/bambu.rs

@@ -49,6 +49,20 @@ impl BambuTls {
             BambuTls::Insecure => &[],
         }
     }
+
+    /// Builds a `native_tls` connector configured for this trust mode:
+    /// trusting only `ca_bytes()`, or accepting anything for `Insecure`.
+    fn build_connector(&self) -> anyhow::Result<native_tls::TlsConnector> {
+        let mut builder = native_tls::TlsConnector::builder();
+
+        if matches!(self, BambuTls::Insecure) {
+            builder.danger_accept_invalid_certs(true);
+        } else {
+            builder.add_root_certificate(native_tls::Certificate::from_pem(self.ca_bytes())?);
+        }
+
+        Ok(builder.build()?)
+    }
 }
 
 pub struct BambuPrinter {
@@ -73,6 +87,29 @@ impl BambuPrinter {
     pub fn dispatch_gcode(&self, file_name: &str) {
         println!("[{}] uploading {file_name} over FTPS", self.base.name);
     }
+
+    /// Attempts a raw TLS handshake to this printer's MQTTS port — no MQTT
+    /// protocol at all, just "does the certificate verify against this
+    /// printer's configured trust mode". This is a real network call
+    /// (blocking, since it's a one-shot diagnostic rather than part of the
+    /// async daemon), useful for testing a printer's certificate before
+    /// building a real MQTT client on top.
+    pub fn test_tls_handshake(&self) -> anyhow::Result<()> {
+        use std::net::ToSocketAddrs;
+
+        let addr = (self.base.host.as_str(), 8883)
+            .to_socket_addrs()?
+            .next()
+            .ok_or_else(|| anyhow::anyhow!("could not resolve {}", self.base.host))?;
+
+        // A plain TcpStream::connect has no timeout — an offline printer
+        // would hang this call forever instead of failing. 5s is plenty
+        // for a LAN.
+        let stream = std::net::TcpStream::connect_timeout(&addr, std::time::Duration::from_secs(5))?;
+        let connector = self.tls.build_connector()?;
+        connector.connect(&self.base.host, stream)?;
+        Ok(())
+    }
 }
 
 impl GenericPrinter for BambuPrinter {