Add printers.toml (gitignored) + real TLS cert test against actual hardware

New:
- printers.example.toml (committed template) / printers.toml (gitignored,
  real hosts + access codes don't belong in git) — a list of real printers
  with vendor, host, access_code/api_key/com_port, and an optional
  per-printer CA override.
- src/fleet.rs loads that file into ready-to-use PrinterHandles, matching
  vendor strings to the right constructor.
- BambuPrinter::test_tls_handshake() does a real (blocking, one-shot) TLS
  handshake to port 8883 using that printer's configured BambuTls trust
  mode — no MQTT protocol, just 'does the certificate verify'. Added
  native-tls and toml as direct dependencies for this.
- examples/test_bambu_certs.rs loads printers.toml and runs the handshake
  test against every Bambu entry.

Also fixes a real bug found while testing against unreachable IPs: plain
TcpStream::connect has no timeout and hung indefinitely on an offline
printer — switched to connect_timeout (5s).

Verified with cargo check --all-targets (0 errors) and by actually running
test_bambu_certs against a local printers.toml (correctly errored on a
missing cert file, then correctly timed out against unreachable test IPs
instead of hanging).

src/fleet.rs

@@ -0,0 +1,84 @@
+//! Loads real printer connection details from a TOML file — see
+//! `printers.example.toml` for the shape. The actual file (`printers.toml`
+//! by default) is gitignored: it holds real hostnames and access codes for
+//! your printers, which don't belong in version control.
+
+use std::path::Path;
+
+use serde::Deserialize;
+
+use crate::printer::{BambuPrinter, BambuTls, KlipperPrinter, PrinterHandle, PrusaLinkPrinter, PrusaSerialPrinter};
+
+#[derive(Debug, Deserialize)]
+struct FleetFile {
+    #[serde(rename = "printer", default)]
+    printers: Vec<PrinterEntry>,
+}
+
+#[derive(Debug, Deserialize)]
+struct PrinterEntry {
+    id: String,
+    name: String,
+    /// One of: "bambu_v1", "bambu_v2", "prusa_link", "prusa_serial", "klipper".
+    vendor: String,
+    host: Option<String>,
+    access_code: Option<String>,
+    api_key: Option<String>,
+    com_port: Option<i16>,
+    /// Path to a printer-specific CA certificate. Leave unset to use the
+    /// bundled Bambu CA — only needed for a printer that doesn't chain to
+    /// it (P1P, at least; see certs/README.md).
+    ca_cert_path: Option<String>,
+    #[serde(default = "default_true")]
+    require_valid_cert: bool,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// Reads and parses a printers file into ready-to-use `PrinterHandle`s.
+pub fn load(path: &Path) -> anyhow::Result<Vec<PrinterHandle>> {
+    let text = std::fs::read_to_string(path).map_err(|err| {
+        anyhow::anyhow!(
+            "failed to read {path:?}: {err} (copy printers.example.toml to printers.toml and fill in your printers)"
+        )
+    })?;
+    let file: FleetFile = toml::from_str(&text)?;
+
+    file.printers.into_iter().map(build_printer).collect()
+}
+
+fn build_printer(entry: PrinterEntry) -> anyhow::Result<PrinterHandle> {
+    match entry.vendor.as_str() {
+        "bambu_v1" | "bambu_v2" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            let access_code = require_field(&entry.id, "access_code", entry.access_code)?;
+            let tls = BambuTls::resolve(entry.ca_cert_path.as_deref().map(Path::new), entry.require_valid_cert)?;
+            let printer = BambuPrinter::new(&entry.id, &entry.name, &host, &access_code, tls);
+            Ok(if entry.vendor == "bambu_v1" {
+                PrinterHandle::BambuV1(printer)
+            } else {
+                PrinterHandle::BambuV2(printer)
+            })
+        }
+        "prusa_link" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            let api_key = require_field(&entry.id, "api_key", entry.api_key)?;
+            Ok(PrinterHandle::PrusaLink(PrusaLinkPrinter::new(&entry.id, &entry.name, &host, &api_key)))
+        }
+        "prusa_serial" => {
+            let com_port = entry.com_port.ok_or_else(|| anyhow::anyhow!("{}: prusa_serial needs com_port", entry.id))?;
+            Ok(PrinterHandle::PrusaSerial(PrusaSerialPrinter::new(&entry.id, &entry.name, com_port)))
+        }
+        "klipper" => {
+            let host = require_field(&entry.id, "host", entry.host)?;
+            Ok(PrinterHandle::Klipper(KlipperPrinter::new(&entry.id, &entry.name, &host)))
+        }
+        other => Err(anyhow::anyhow!("{}: unknown vendor '{other}'", entry.id)),
+    }
+}
+
+fn require_field(printer_id: &str, field: &str, value: Option<String>) -> anyhow::Result<String> {
+    value.ok_or_else(|| anyhow::anyhow!("{printer_id}: missing required field '{field}'"))
+}