fix(mqtt): trust GTS WE1 for eastmesh/meshmapper broker TLS

mqtt2.eastmesh.au switched from a Let's Encrypt cert to a Google Trust
Services WE1-issued *.eastmesh.au wildcard (July 2026), so devices on the
pinned-PEM fallback path failed the handshake with mbedTLS -9984. Pin the
combined ISRG Root X1 + GTS WE1 bundle for these brokers so either chain
verifies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/helpers/mqtt/MQTTCaCerts.h

@@ -2,7 +2,8 @@
 
 namespace mqtt_ca_certs {
 
-// EastMesh currently presents a Let's Encrypt E7-issued certificate.
+// EastMesh presented a Let's Encrypt E7-issued certificate until July 2026,
+// when it moved to a Google Trust Services WE1 wildcard (see kCombinedPem).
 static const char kEastmeshIsrgRootX1Pem[] =
 R"PEM(-----BEGIN CERTIFICATE-----
 MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw

src/helpers/mqtt/MQTTUplink.cpp

@@ -202,7 +202,9 @@ const char* MQTTUplink::brokerCaCert(const BrokerSpec& spec) {
   // Note: ESP32 targets with the certificate bundle attach it instead of these PEMs;
   // this fallback only applies on builds without CONFIG_MBEDTLS_CERTIFICATE_BUNDLE.
   if (spec.bit == kEastmeshBit || spec.bit == kMeshmapperBit) {
-    return mqtt_ca_certs::kEastmeshIsrgRootX1Pem;  // Let's Encrypt ISRG Root X1
+    // eastmesh.au switched from Let's Encrypt to a Google Trust Services WE1
+    // wildcard cert (July 2026); trust both so a switch back doesn't brick uplinks.
+    return mqtt_ca_certs::kCombinedPem;  // ISRG Root X1 + GTS WE1
   }
   // waev (mqtt.waev.app) presents a Google Trust Services WE1 chain, same issuer as LetsMesh.
   return mqtt_ca_certs::kLetsmeshWe1Pem;  // Google Trust Services WE1