Implement TLS connector with certificate pinning and retry logic for the client

Add a complete TLS connection path to PwrClient, replacing the previous
stub that returned a not-yet-implemented error. The connect_tls function
builds a rustls ClientConfig with webpki root certificates for standard
PKI validation. When a server_fingerprint is set in the client config, a
custom FingerprintVerifier replaces the default verifier. This verifier
computes the SHA-256 hash of the server’s end-entity certificate DER
bytes and compares it against the pinned hex fingerprint, implementing
trust-on-first-use style certificate pinning without requiring a private
CA. The verifier supports TLS 1.2 and 1.3 signature schemes including
RSA and ECDSA P-256.

The PwrClient struct gains server_addr, psk, and pinned_fingerprint
fields, enabling a reconnect method that re-establishes a TCP connection
to the same server and re-runs the PSK handshake without reloading the
config file. The connect method now branches on use_tls, routing to
either the TLS path with certificate validation or the plaintext path
for local testing.

Add retry logic via the with_retry helper, a generic function that wraps
any fallible operation with exponential backoff. The caller provides a
retryable-error predicate; is_retryable_error recognizes connection
refused, timeout, connection closed, connection reset, broken pipe, and
unexpected EOF as transient errors worth retrying. The base delay
doubles each attempt, with a configurable maximum number of retries.