Slim OpenHTF uploads, trust private CAs

Stations that only upload no longer install a full test framework, and self-hosted instances behind a corporate certificate authority work end to end.

• Removed the TofuPilot context manager and its streaming stack from the Python client — uploads go through the upload() output callback, and the CLI provides the live operator UI.
• Made OpenHTF an optional extra: install tofupilot[openhtf] for the callback, plain tofupilot for API-only stations.
• Added private CA support to the CLI: pass --ca-cert at login or set TOFUPILOT_CA_CERT, and the saved certificate is reused by unattended stations across logins.
• Neutralized leftover upload() callbacks under tofupilot run, so migrated procedures work unedited without crashing on a missing API key or creating duplicate runs.
• Fixed custom CA bundles replacing the trust store instead of extending it, which broke attachment uploads to publicly-signed storage hosts.