Add printers.toml (gitignored) + real TLS cert test against actual hardware

New:
- printers.example.toml (committed template) / printers.toml (gitignored,
  real hosts + access codes don't belong in git) — a list of real printers
  with vendor, host, access_code/api_key/com_port, and an optional
  per-printer CA override.
- src/fleet.rs loads that file into ready-to-use PrinterHandles, matching
  vendor strings to the right constructor.
- BambuPrinter::test_tls_handshake() does a real (blocking, one-shot) TLS
  handshake to port 8883 using that printer's configured BambuTls trust
  mode — no MQTT protocol, just 'does the certificate verify'. Added
  native-tls and toml as direct dependencies for this.
- examples/test_bambu_certs.rs loads printers.toml and runs the handshake
  test against every Bambu entry.

Also fixes a real bug found while testing against unreachable IPs: plain
TcpStream::connect has no timeout and hung indefinitely on an offline
printer — switched to connect_timeout (5s).

Verified with cargo check --all-targets (0 errors) and by actually running
test_bambu_certs against a local printers.toml (correctly errored on a
missing cert file, then correctly timed out against unreachable test IPs
instead of hanging).

src/printer/bambu.rs

@@ -49,6 +49,20 @@ impl BambuTls {
             BambuTls::Insecure => &[],
         }
     }
+
+    /// Builds a `native_tls` connector configured for this trust mode:
+    /// trusting only `ca_bytes()`, or accepting anything for `Insecure`.
+    fn build_connector(&self) -> anyhow::Result<native_tls::TlsConnector> {
+        let mut builder = native_tls::TlsConnector::builder();
+
+        if matches!(self, BambuTls::Insecure) {
+            builder.danger_accept_invalid_certs(true);
+        } else {
+            builder.add_root_certificate(native_tls::Certificate::from_pem(self.ca_bytes())?);
+        }
+
+        Ok(builder.build()?)
+    }
 }
 
 pub struct BambuPrinter {
@@ -73,6 +87,29 @@ impl BambuPrinter {
     pub fn dispatch_gcode(&self, file_name: &str) {
         println!("[{}] uploading {file_name} over FTPS", self.base.name);
     }
+
+    /// Attempts a raw TLS handshake to this printer's MQTTS port — no MQTT
+    /// protocol at all, just "does the certificate verify against this
+    /// printer's configured trust mode". This is a real network call
+    /// (blocking, since it's a one-shot diagnostic rather than part of the
+    /// async daemon), useful for testing a printer's certificate before
+    /// building a real MQTT client on top.
+    pub fn test_tls_handshake(&self) -> anyhow::Result<()> {
+        use std::net::ToSocketAddrs;
+
+        let addr = (self.base.host.as_str(), 8883)
+            .to_socket_addrs()?
+            .next()
+            .ok_or_else(|| anyhow::anyhow!("could not resolve {}", self.base.host))?;
+
+        // A plain TcpStream::connect has no timeout — an offline printer
+        // would hang this call forever instead of failing. 5s is plenty
+        // for a LAN.
+        let stream = std::net::TcpStream::connect_timeout(&addr, std::time::Duration::from_secs(5))?;
+        let connector = self.tls.build_connector()?;
+        connector.connect(&self.base.host, stream)?;
+        Ok(())
+    }
 }
 
 impl GenericPrinter for BambuPrinter {