fix(wasi): add wss:// TLS support to WASI client (tungstenite rustls-tls)

[NikolayS]

Problem

PR #706 compiles tungstenite with features = ["handshake"] only — no TLS backend. Connecting to a wss:// URL will fail. The PG_WSS_URL env var name implies WSS but TLS isn't enabled.

The team's proxy now enforces SSL, so ws:// is no longer sufficient.

Fix

Add rustls-tls feature to tungstenite in Cargo.toml:

tungstenite = { version = "0.26", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"], optional = true }

rustls-tls-webpki-roots is the WASI-compatible choice (no native cert store dependency).

Must verify:

• cargo build --target wasm32-wasip2 --features wasi --no-default-features still succeeds
• wss:// URL connects successfully under wasmtime with -S tcp -S allow-ip-name-lookup
• ws:// still works (regression)

Context

• PR feat(wasi): implement WSS client backend #706 branch: feat/wasi-client
• Proxy: wss://localhost:8080 (SSL enforced)
• wasmtime ≥43 with wasip2 required