adapters install rustls ring provider before reqwest client; tui keyring deps to workspace; doc fixes

crates/adapters/metadata/Cargo.toml

@@ -8,5 +8,6 @@ config = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
 serde = { workspace = true, features = ["derive"] }
 domain = { workspace = true }

crates/adapters/metadata/src/omdb.rs

@@ -16,6 +16,8 @@ pub(crate) struct OmdbProvider {
 
 impl OmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/src/tmdb.rs

@@ -15,6 +15,8 @@ pub(crate) struct TmdbProvider {
 
 impl TmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/tests/client_tls_omdb.rs

@@ -0,0 +1,6 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+#[test]
+fn omdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_omdb("key".into());
+}

crates/adapters/metadata/tests/client_tls_tmdb.rs

@@ -0,0 +1,6 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+#[test]
+fn tmdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_tmdb("key".into());
+}

crates/adapters/poster-fetcher/Cargo.toml

@@ -8,4 +8,5 @@ config = { workspace = true }
 domain = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
 anyhow = { workspace = true }

crates/adapters/poster-fetcher/src/lib.rs

@@ -16,6 +16,8 @@ pub struct ReqwestPosterFetcher {
 
 impl ReqwestPosterFetcher {
     pub fn new(config: PosterFetcherConfig) -> anyhow::Result<Self> {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let client = reqwest::Client::builder()
             .timeout(Duration::from_secs(config.timeout_seconds))
             .build()?;

crates/adapters/poster-fetcher/tests/client_tls.rs

@@ -0,0 +1,8 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+use poster_fetcher::{PosterFetcherConfig, ReqwestPosterFetcher};
+
+#[test]
+fn poster_fetcher_builds_without_bootstrap() {
+    ReqwestPosterFetcher::new(PosterFetcherConfig { timeout_seconds: 5 }).expect("client builds");
+}

crates/adapters/tmdb-enrichment/Cargo.toml

@@ -7,6 +7,7 @@ edition.workspace = true
 config = { workspace = true }
 domain      = { workspace = true }
 reqwest     = { workspace = true }
+rustls      = { workspace = true, features = ["ring", "std"] }
 serde       = { workspace = true, features = ["derive"] }
 async-trait = { workspace = true }
 chrono      = { workspace = true }

crates/adapters/tmdb-enrichment/src/client.rs

@@ -12,6 +12,8 @@ impl TmdbEnrichmentClient {
             .tmdb_api_key
             .clone()
             .ok_or_else(|| DomainError::InfrastructureError("TMDB_API_KEY is not set".into()))?;
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Ok(Self {
             api_key,
             http: reqwest::Client::new(),

crates/adapters/tmdb-enrichment/tests/client_tls.rs

@@ -0,0 +1,12 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+use tmdb_enrichment::TmdbEnrichmentClient;
+
+#[test]
+fn tmdb_enrichment_builds_without_bootstrap() {
+    let cfg = config::MetadataConfig {
+        tmdb_api_key: Some("key".into()),
+        ..Default::default()
+    };
+    TmdbEnrichmentClient::from_config(&cfg).expect("client builds");
+}