fix backend system trust store

[fengju0213]

Why

Eigent Desktop's backend runs inside a bundled Python environment, so model validation can rely on Python's default CA bundle instead of the operating system trust store. On Windows, this means a remote Ollama endpoint behind HTTPS with a system-trusted private CA can still fail during CAMEL/OpenAI-compatible validation with CERTIFICATE_VERIFY_FAILED.

Fixes #1688.

What Changed

• Add truststore to the backend dependencies and lockfile.
• Inject the system trust store early in backend/main.py, before the app imports routers or creates provider clients, so downstream httpx/OpenAI/CAMEL calls can honor OS-trusted certificates.
• Keep a warning fallback to the default CA bundle if trust store injection is unavailable or fails.

Validated with uv lock --check, uv run ruff check main.py, uv run python -m py_compile main.py, and a direct truststore.inject_into_ssl() smoke check.