feat(relays): accept a self-signed certificate on a generic HTTP board

HTTPS to a relay board could not work. Nearly every board that offers it signs
its own certificate — there is no authority anywhere that could have signed it —
so the request failed verification before it left.

A checkbox, per board, off by default. Not a blanket switch, because the other
HTTPS case is real and opposite: a board reached from outside through a proxy
with a genuine certificate, where verification is the only thing standing
between an antenna switch and the internet. Same setting, two boards, different
answers.

Off by default is only safe if the failure explains itself, so a certificate
error now names the box to tick. Go's own "x509: certificate signed by unknown
authority" is accurate and tells an operator nothing about what to do next.

Shown only once an https:// URL is actually in the board's configuration. A
board on plain HTTP has no certificate to argue about, and an option that cannot
matter yet is one more thing to wonder about.

The flag joins the driver cache key: ticking it has to rebuild the driver, or
the cached one would go on refusing the certificate with the verifying client it
already holds.

The boards that take a bare host — WebSwitch, KMTronic — keep verification. An
https:// typed there is the proxy case by construction, since they default to
plain HTTP on the LAN.

Three tests against a real self-signed TLS server: accepted with the box,
refused with a message naming it without the box, and one board's setting not
leaking into another's.

internal/relaydev/httpgen_test.go

@@ -22,7 +22,7 @@ func TestHTTPGenericPattern(t *testing.T) {
 
 	d := NewHTTPGeneric(nil, nil,
 		srv.URL+"/relay?n={relay}&state=on",
-		srv.URL+"/relay?n={relay}&state=off", "", "", 4, nil)
+		srv.URL+"/relay?n={relay}&state=off", "", "", 4, nil, false)
 	if err := d.Set(context.Background(), 2, true); err != nil {
 		t.Fatalf("Set on: %v", err)
 	}
@@ -53,7 +53,7 @@ func TestHTTPGenericPerRelayURLsWinOverThePattern(t *testing.T) {
 	d := NewHTTPGeneric(
 		[]string{srv.URL + "/FF0101", "", srv.URL + "/weird/on"},
 		[]string{srv.URL + "/FF0100", "", ""},
-		srv.URL+"/pattern/on/{relay}", srv.URL+"/pattern/off/{relay}", "", "", 3, nil)
+		srv.URL+"/pattern/on/{relay}", srv.URL+"/pattern/off/{relay}", "", "", 3, nil, false)
 
 	_ = d.Set(context.Background(), 1, true)  // its own URL
 	_ = d.Set(context.Background(), 2, true)  // empty → falls back to the pattern
@@ -82,7 +82,7 @@ func TestHTTPGenericValueIsTheRelayLabel(t *testing.T) {
 		[]string{srv.URL + "/relay?on={value}"}, // per-relay URL
 		nil,
 		"", srv.URL+"/relay?off={value}", // and the pattern, for the other direction
-		"", "", 3, []string{"Ant1", "Beam 20m", ""})
+		"", "", 3, []string{"Ant1", "Beam 20m", ""}, false)
 	_ = d.Set(context.Background(), 1, true)
 	_ = d.Set(context.Background(), 2, false)
 	mu.Lock()
@@ -107,7 +107,7 @@ func TestHTTPGenericRelayOffset(t *testing.T) {
 	defer srv.Close()
 
 	d := NewHTTPGeneric(nil, nil,
-		srv.URL+"/set0/{relay-1}/1", srv.URL+"/set0/{relay-1}/0", "", "", 4, nil)
+		srv.URL+"/set0/{relay-1}/1", srv.URL+"/set0/{relay-1}/0", "", "", 4, nil, false)
 	_ = d.Set(context.Background(), 1, true)
 	_ = d.Set(context.Background(), 4, false)
 	mu.Lock()
@@ -123,7 +123,7 @@ func TestHTTPGenericRelayOffset(t *testing.T) {
 // movement. It must be refused, and the message must say the label is what is
 // missing.
 func TestHTTPGenericRefusesValueWithoutALabel(t *testing.T) {
-	d := NewHTTPGeneric(nil, nil, "http://x/relay?on={value}", "", "", "", 2, []string{"", ""})
+	d := NewHTTPGeneric(nil, nil, "http://x/relay?on={value}", "", "", "", 2, []string{"", ""}, false)
 	err := d.Set(context.Background(), 1, true)
 	if err == nil || !strings.Contains(err.Error(), "label") {
 		t.Errorf("err = %v, want it to name the missing label", err)
@@ -149,7 +149,7 @@ func TestHTTPGenericSuppliesTheScheme(t *testing.T) {
 // A switch with the ON URLs filled and OFF left empty latches. The error has to
 // name the direction, or the operator cannot tell which half is missing.
 func TestHTTPGenericNamesTheMissingDirection(t *testing.T) {
-	d := NewHTTPGeneric([]string{"http://x/on"}, nil, "", "", "", "", 1, nil)
+	d := NewHTTPGeneric([]string{"http://x/on"}, nil, "", "", "", "", 1, nil, false)
 	err := d.Set(context.Background(), 1, false)
 	if err == nil || !strings.Contains(err.Error(), "OFF") {
 		t.Errorf("err = %v, want it to name the OFF direction", err)
@@ -160,7 +160,7 @@ func TestHTTPGenericNamesTheMissingDirection(t *testing.T) {
 func TestHTTPGenericRemembersWhatItCommanded(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
 	defer srv.Close()
-	d := NewHTTPGeneric(nil, nil, srv.URL+"/on/{relay}", srv.URL+"/off/{relay}", "", "", 3, nil)
+	d := NewHTTPGeneric(nil, nil, srv.URL+"/on/{relay}", srv.URL+"/off/{relay}", "", "", 3, nil, false)
 	_ = d.Set(context.Background(), 2, true)
 	st, err := d.Status(context.Background())
 	if err != nil {