Add bound Samsung server certificate profile

[Jason-Morcos]

Context

This is the third authentication slice agreed in #28. The no-behavior-change CertificateAuth refactor (#31) and the isolated PskAuth provider (#32) are now merged and released as v0.1.4 and v0.1.5.

I have several Samsung appliances operating locally in a private Home Assistant deployment. For the newer laundry certificate cohort, an already-authorized connection required all of these details together:

1. an existing authorized client certificate and key;
2. a P-256 ClientHello limited to ECDHE-ECDSA-AES128-GCM-SHA256;
3. the ordered signature offer RSA+SHA256:ECDSA+SHA256:RSA+SHA1:ECDSA+SHA1, with session tickets disabled;
4. the applicable Samsung CA chain; and
5. verification that the server leaf has the Samsung home-appliance role and contains the exact expected OCF UUID.

What changes

• Adds immutable, opt-in SamsungServerProfile.bound_device(...).
• Integrates the profile through the existing CertificateAuth.from_files and from_memory factories.
• Keeps the default CertificateAuth context setup and verification callback unchanged.
• Restricts the profiled ClientHello to P-256, the existing ECDSA cipher, the observed ordered signature set, and no session ticket.
• Preserves normal chain verification while binding the verified leaf to:
  • C=KR
  • O=Samsung Electronics
  • OU=OCF HA Device
  • one canonical, non-zero OCF UUID in the common name
• Allows one to four optional, context-scoped additional CA certificates and rejects malformed PEM, trailing content, duplicate certificates, leaf trust anchors, and missing CA constraints.
• Includes a pyOpenSSL 23.1 compatibility path whose emitted ClientHello is wire-tested against the current exact curve-list path.

How this relates to #16 and #20

• Newer Samsung firmware uses standard OCF ports (5683/5684) + non-AC14K_M trust anchor #16 describes an already-owned, newer-PKI appliance. This profile supplies the missing exact connection and server-identity contract when the caller already has an authorized client identity. It does not discover or create that identity.
• Can't connect to BespokeAI Washer/Dryer #20 describes an unowned vendor-OTM appliance. This PR does not make that device connectable by itself: it cannot acquire or install an owner credential, and it performs no ownership transfer.

Credential discovery, minting, authorization, provisioning, rotation, persistence, OTM, cloud/account access, and OCF security-resource writes remain intentionally out of scope.

Validation

• 175 tests with current dependencies.
• 175 tests on Python 3.11 with the declared pyOpenSSL 23.1 dependency floor.
• All 1,070 LocalThings tests against this exact package.
• Generated valid/invalid chains, matching/mismatched identities, missing CA extensions, malformed subjects, default/profile isolation, and cold-context reuse.
• Wire-level assertions for cipher suites, P-256 supported groups, signature algorithms, and absent session tickets on both OpenSSL paths.
• Share-safety, targeted Ruff, distribution contents, exact-head wheel/sdist build, and isolated wheel import all pass.
• Commit 4138905 is signed and uses Jason's GitHub noreply address.

Merge order

1. refactor(protocol): add certificate authentication provider #31 — merged
2. feat(protocol): add PSK authentication provider #32 — merged
3. This PR

This PR has no dependency on unmerged work.