k-ap 0.5.1; reqwest ring-only, sqlx no tls; bootstrap installs ring provider

crates/tui/Cargo.toml

@@ -26,6 +26,7 @@ windows-native-keyring-store = { version = "1.0.0", optional = true }
 
 api-types = { workspace = true }
 reqwest = { workspace = true }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }

crates/tui/src/client.rs

@@ -46,6 +46,8 @@ pub struct ApiClient {
 
 impl ApiClient {
     pub fn new(url: &str) -> Self {
+        // reqwest is built without a bundled TLS provider; install ring first.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             base_url: std::sync::RwLock::new(url.to_string()),
             http: reqwest::Client::new(),