OCPP: per-charger credentials and TLS belong in the Chargers panel #1016

Follow-up to #999 and #1015. The Chargers panel now configures the whole OCPP server — except two things #999 deliberately left in config.yaml:

• Per-charger credentials (ocpp.chargers): plain id + password pairs, well suited to a small list editor in the panel. The secret-masking machinery already matches per-charger passwords by id (MaskSecrets/PreserveMaskedSecrets), so the API side is ready. This is the remaining "edit a file" step in the recommended hardening path, and the impersonation fix only protects chargers that are listed.
• TLS (ocpp.tls): cert/key/client-CA are file paths on the box, so a UI needs either path fields with existence validation or a cert upload flow. Bigger scope — decide which before building.

Principle (owner directive): everything configurable belongs in the UI; config files are not a user interface. These are the last two OCPP exceptions.