✨ Add option to allow insecure TLS connections

[Reverier-Xu]

Description

Adds a settings entry that allows ignoring insecure TLS situations: when enabled, wsrx connects to wss:// remotes without verifying the server certificate, unconditionally trusting any certificate (including self-signed, expired, or hostname-mismatched ones). The option is disabled by default.

Changes

wsrx crate (crates/wsrx/src/tunnel.rs)

• New Tunnel::with_insecure_tls() constructor alongside the existing Tunnel::new() (which keeps full verification — CLI behavior is unchanged).
• Implements a rustls danger::ServerCertVerifier that accepts every certificate. Signature schemes are taken from the process-wide crypto provider (AWS-LC with ring fallback).
• Connections use connect_async_tls_with_config with a custom Connector::Rustls only when the insecure option is active.

Desktop (crates/desktop)

• models.rs: new insecure_tls: bool field on WsrxDesktopConfig, #[serde(default)] → off by default, persisted in config.toml.
• daemon.rs: the flag is read at launch time and threaded into tunnel creation; a warning is logged when the user enables it.
• daemon/workers.rs: the latency-probe reqwest client follows the same certificate policy and is rebuilt when the setting changes, so probes no longer fail (and pingfall no longer drops instances) purely due to invalid certificates.
• Settings UI: new toggle entry (default Disabled) with a danger-colored warning about man-in-the-middle attacks.
• Connections UI: while the option is enabled, connection entries whose remote starts with wss:// display an insecure icon (ShieldError, danger color).
• i18n: en_US / zh_CN / zh_TW strings for the new entry and warning.

Screenshots

(UI toggle + warning row; insecure icon marker on wss:// entries)

Checklist

• cargo check --workspace --all-targets passes
• cargo clippy — no new warnings
• cargo fmt --check passes