Fix web radio streaming: HTTPS URLs were rejected outright

POST /api/streaming's JSON parser only accepted "http://" URLs,
rejecting any "https://" URL with invalid_json before ever attempting
a connection. Nearly every real internet radio stream today is HTTPS-
only, so this made the feature fail for essentially any station a
user would actually try.

Two changes were needed together: the parser now accepts both http://
and https://, and web_radio_stream.cpp's esp_http_client now attaches
ESP-IDF's built-in CA certificate bundle (crt_bundle_attach) so the
TLS handshake actually verifies -- CONFIG_MBEDTLS_CERTIFICATE_BUNDLE
was already enabled in sdkconfig but never wired up here. Requires
adding mbedtls to main's PRIV_REQUIRES (esp_crt_bundle.h lives there).

Confirmed live: an https:// stream URL now gets accepted by the API
and produces a real HTTP response (404, from a guessed-wrong path) --
before this fix it never reached the network at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Software/main/web_radio_stream.cpp

@@ -13,6 +13,7 @@
 #include "esp32_i2s_sink.hpp"
 #include "webradio/WebRadioService.hpp"
 
+#include "esp_crt_bundle.h"
 #include "esp_http_client.h"
 #include "esp_log.h"
 #include "freertos/FreeRTOS.h"
@@ -48,6 +49,12 @@ struct InputBuffer {
     esp_http_client_config_t cfg{};
     cfg.url = url.c_str();
     cfg.timeout_ms = kHttpTimeoutMs;
+    // Most public internet radio streams are HTTPS-only today; esp_http_client
+    // needs an explicit trust anchor for TLS verification or the handshake
+    // fails outright. CONFIG_MBEDTLS_CERTIFICATE_BUNDLE is already enabled
+    // (sdkconfig), so attach ESP-IDF's built-in CA bundle -- this is a no-op
+    // for plain http:// URLs.
+    cfg.crt_bundle_attach = esp_crt_bundle_attach;
     esp_http_client_handle_t client = esp_http_client_init(&cfg);
     if (client == nullptr) {
         ESP_LOGE(kTag, "esp_http_client_init failed");