feat(zigbee): add MQTT TLS support with optional cert verify skip

- Schema: mqtt_tls + mqtt_tls_insecure flags on import + test-connection
  requests; model_validator enforces insecure requires tls
- Service: _build_tls_context() using ssl.create_default_context();
  logger.warning when verification disabled; tls_context plumbed into
  aiomqtt.Client for both fetch_networkmap and test_mqtt_connection
- Route: passes tls flags through to service
- Frontend: TLS checkbox auto-toggles port 1883<->8883 unless user
  edited; insecure checkbox disabled until TLS on, red-tinted; password
  field marked autocomplete=new-password
- Tests: 7 new backend tests (TLS context build, client kwargs assertion,
  router happy path, insecure-without-tls 422)

frontend/src/api/client.ts

@@ -79,6 +79,8 @@ export const zigbeeApi = {
     mqtt_port: number
     mqtt_username?: string
     mqtt_password?: string
+    mqtt_tls?: boolean
+    mqtt_tls_insecure?: boolean
   }) =>
     api.post<{ connected: boolean; message: string }>('/zigbee/test-connection', data),
 
@@ -88,6 +90,8 @@ export const zigbeeApi = {
     mqtt_username?: string
     mqtt_password?: string
     base_topic?: string
+    mqtt_tls?: boolean
+    mqtt_tls_insecure?: boolean
   }) =>
     api.post<{
       nodes: import('@/components/zigbee/types').ZigbeeNode[]