fix(cli): use rustls native roots for WSS

tokio-tungstenite was built with rustls-tls-webpki-roots (compiled-in
Mozilla bundle), so WSS could never trust private-CA relays (e.g. the
homelab Home Lab CA on buzz.bjzy.me) regardless of keychain or
SSL_CERT_FILE. Switch to rustls-tls-native-roots: macOS keychain /
Linux system bundle, so private relays work where the CA is trusted.

Author: BrianInAz

Cargo.toml

@@ -120,7 +120,9 @@ moka    = { version = "0.12", features = ["sync"] }
 futures-util = "0.3"
 
 # WebSocket client (test client)
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+# native roots: WSS must trust private-CA relays (e.g. homelab Home Lab CA);
+# webpki-roots baked in a Mozilla-only bundle and can never trust a private CA.
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-native-roots"] }
 url = "2"
 
 # Property-based testing (dev-only)