Trust a private CA from the install command

Self-hosted instances behind a private certificate authority no longer need the CA file copied onto every station: the instance publishes its CA bundle, the dashboard puts the bundle's fingerprint into the install command, and the CLI refuses the bundle unless the fingerprint matches before it trusts anything.

• Added SSL_CA_CERT_PATH to the self-hosting deploy script, which validates the bundle, publishes it on the instance and checks the dashboard, storage and realtime hosts against it
• Added tofupilot login --ca-cert-sha256, carried by the station install card and the Studio connect screen, with the CA subject and expiry shown next to the command
• Improved CA handling on stations: a rotated CA is adopted automatically over the existing connection, tofupilot whoami shows the CA in effect, certificate errors name the fix, and the CLI's own updates never trust a customer CA