adapters install rustls ring provider before reqwest client; tui keyring deps to workspace; doc fixes

crates/adapters/metadata/Cargo.toml

@@ -8,5 +8,6 @@ config = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
 serde = { workspace = true, features = ["derive"] }
 domain = { workspace = true }

crates/adapters/metadata/src/omdb.rs

@@ -16,6 +16,8 @@ pub(crate) struct OmdbProvider {
 
 impl OmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/src/tmdb.rs

@@ -15,6 +15,8 @@ pub(crate) struct TmdbProvider {
 
 impl TmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/tests/client_tls_omdb.rs

@@ -0,0 +1,6 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+#[test]
+fn omdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_omdb("key".into());
+}

crates/adapters/metadata/tests/client_tls_tmdb.rs

@@ -0,0 +1,6 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+#[test]
+fn tmdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_tmdb("key".into());
+}