fix(tls): Load custom CA and client certificates for SSL connections

[sionsmith]

Summary

Fixes #3

The Kafka client was ignoring ssl_ca_location, ssl_certificate_location, and ssl_key_location configuration fields, causing "UnknownIssuer" errors when connecting to brokers with self-signed or internal CA certificates.

Changes

• Add TLS configuration module (kafka/tls.rs) that properly loads:
  • Custom CA certificates from ssl_ca_location
  • Client certificates for mTLS from ssl_certificate_location
  • Client private keys from ssl_key_location
• Falls back to webpki-roots when no custom CA is specified
• Add TLS-specific error variants for clear error messages
• Add unit tests for certificate loading (7 tests)
• Add integration test infrastructure with Docker Compose
• Update configuration documentation with TLS examples

Files Changed

File	Description
crates/kafka-backup-core/src/kafka/tls.rs	New TLS configuration module
crates/kafka-backup-core/src/kafka/client.rs	Use new TLS config builder
crates/kafka-backup-core/src/error.rs	Add TLS error variants
docs/configuration.md	Add TLS/SSL documentation
tests/tls-test-infra/	Docker Compose + cert generation for testing

Test plan

• Unit tests pass: cargo test -p kafka-backup-core tls (7 tests)
• All existing tests pass: cargo test -p kafka-backup-core (89 tests)
• Manual testing with TLS Kafka (custom CA) - verified working
• Manual testing with mTLS Kafka (client certs) - verified working
• Clippy passes with no warnings

To run integration tests manually:

# Generate test certificates
./tests/tls-test-infra/generate-certs.sh

# Start TLS Kafka
docker-compose -f tests/tls-test-infra/docker-compose-tls.yml up -d

# Run integration tests
cargo test --test integration_suite_tests -- --ignored tls

🤖 Generated with Claude Code

[sionsmith]

Breaking Change Acknowledgment

The semver-check CI is failing because this PR adds new error variants to the KafkaError enum:

• TlsConfig
• CertificateLoad
• PrivateKeyLoad

This is technically a breaking change for code that exhaustively pattern-matches on KafkaError without a wildcard.

However, this is intentional and acceptable because:

1. The project is pre-1.0 (v0.3.0), where breaking changes in minor releases are expected per semver
2. This change is necessary to fix Issue Unable to connect to broker when using ssl configuration #3 (TLS certificate support)
3. The error enum is primarily used internally; external users typically use wildcard matches

Recommendation: Merge this PR and bump the minor version (0.3.0 → 0.4.0) in the next release to indicate potential breaking changes.