Add verified WSS transport for legacy boards

Configure the default WSS endpoint and ISRG Root X2 trust anchor, preserve device authentication, enforce TLS and WebSocket handshake validation, and handle partial I/O and connection cleanup. Add host tests, server probes, package verification and integration documentation. Backend 443 /ws still returns HTTP 404; on-device validation remains pending.

ql-application/threadx/interface/custom_app/inc/talkingq_wss.h

@@ -0,0 +1,20 @@
+#ifndef TALKINGQ_WSS_H
+#define TALKINGQ_WSS_H
+
+#include <stddef.h>
+
+#define TALKINGQ_WSS_URL "wss://banban.api.talkingq.com:443/ws"
+#define TALKINGQ_URL_CAPACITY 64
+#define TALKINGQ_HOST_CAPACITY 64
+#define TALKINGQ_PATH_CAPACITY 128
+
+extern const char talkingq_root_ca[];
+extern const size_t talkingq_root_ca_size;
+
+/* Reject cleartext, malformed authorities, invalid ports and oversized URLs. */
+int talkingq_parse_wss_url(const char *url, char *host, size_t host_size,
+                          int *port, char *path, size_t path_size);
+/* Only the former built-in endpoints migrate; custom WSS endpoints are kept. */
+int talkingq_is_legacy_ws_url(const char *url);
+
+#endif