adapters install rustls ring provider before reqwest client; tui keyring deps to workspace; doc fixes

crates/adapters/poster-fetcher/Cargo.toml

@@ -8,4 +8,5 @@ config = { workspace = true }
 domain = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
 anyhow = { workspace = true }

crates/adapters/poster-fetcher/src/lib.rs

@@ -16,6 +16,8 @@ pub struct ReqwestPosterFetcher {
 
 impl ReqwestPosterFetcher {
     pub fn new(config: PosterFetcherConfig) -> anyhow::Result<Self> {
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let client = reqwest::Client::builder()
             .timeout(Duration::from_secs(config.timeout_seconds))
             .build()?;

crates/adapters/poster-fetcher/tests/client_tls.rs

@@ -0,0 +1,8 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+use poster_fetcher::{PosterFetcherConfig, ReqwestPosterFetcher};
+
+#[test]
+fn poster_fetcher_builds_without_bootstrap() {
+    ReqwestPosterFetcher::new(PosterFetcherConfig { timeout_seconds: 5 }).expect("client builds");
+}