S5 + TLS 1.3 client: real SHA-256/HMAC/AES-GCM/ChaCha20-Poly1305/X25519/Ed25519 in Home, certificate verification with a bundled root store, used by HTTPS sources, metadata, OTA signature checks

Epic: #113 · Milestone: MC8 — Library & services

Why

Stub S5: chacha20/poly1305/curve25519/blake2s are stubs; net/tls.home is a TLS 1.2 record path on top. Everything internet-facing (TMDB, HLS over HTTPS, OTA image signatures, SMB NTLMv2) needs this. ~/Code/Libraries/zig-tls and the stdlib http/tls.zig exist as references for structure, but crypto here stays in Home (kernel/userspace-shared lib).

Tasks

• Primitives with test vectors (RFC/NIST KATs in CI): SHA-256/512, HMAC, HKDF, AES-128/256-GCM (with a NEON/crypto-extension path on A76 — aese/aesmc via intrinsics, rung 12 of #51), ChaCha20-Poly1305, X25519, Ed25519, MD4/MD5 (legacy, for NTLM only), constant-time compare.
• TLS 1.3 client (1.2 optional): handshake, key schedule, record layer, SNI, ALPN, session resumption; X.509 parsing, chain building, name matching, a bundled root store updated via OTA.
• Throughput target ≥ 200 Mbit/s AES-GCM on the Pi.
• Close S5 in the stub register.

Acceptance

https:// GET of a 100 MB file from the Mac's local server succeeds on the rig; KATs green; stub-register shows S5 closed.

Size: L · Depends on: #69 (for hardware test) — crypto itself can start now on x86 · Blocks: #103, #87, #109, #104