fix(desktop): trust native roots for relay websockets

[BrianInAz]

Summary

• configure native desktop WebSockets to use the operating system certificate store
• align relay WebSocket trust behavior with the existing HTTP client
• add an opt-in network regression test for OS-trusted WSS endpoints

Root cause

The HTTP relay queries succeeded because the HTTP client used platform certificate trust, while tokio-tungstenite was compiled with Mozilla WebPKI roots only. On systems where the relay chain is trusted through the OS certificate store, the native WSS handshake failed with UnknownIssuer. Cached/query data could still populate channels and DMs, leaving the sidebar to report that the relay was unreachable.

Validation

• native WSS regression failed with UnknownIssuer before the feature change and passed afterward against wss://buzz.bjzy.me
• native WebSocket module: 6 passed, 1 ignored
• full Tauri test suite: 2,114 passed, 15 ignored
• Clippy passed with warnings denied
• Rust formatting and diff checks passed
• rodio diagnostics: 3 passed
• installed 0.5.3-bjzy acceptance build retained an established relay socket through multiple heartbeat intervals; channels/DMs loaded and the warning card remained absent

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.