adapters install rustls ring provider before reqwest client; tui keyring deps to workspace; doc fixes

crates/adapters/tmdb-enrichment/Cargo.toml

@@ -7,6 +7,7 @@ edition.workspace = true
 config = { workspace = true }
 domain      = { workspace = true }
 reqwest     = { workspace = true }
+rustls      = { workspace = true, features = ["ring", "std"] }
 serde       = { workspace = true, features = ["derive"] }
 async-trait = { workspace = true }
 chrono      = { workspace = true }

crates/adapters/tmdb-enrichment/src/client.rs

@@ -12,6 +12,8 @@ impl TmdbEnrichmentClient {
             .tmdb_api_key
             .clone()
             .ok_or_else(|| DomainError::InfrastructureError("TMDB_API_KEY is not set".into()))?;
+        // reqwest is built with rustls-no-provider; install ring so this works without bootstrap.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Ok(Self {
             api_key,
             http: reqwest::Client::new(),

crates/adapters/tmdb-enrichment/tests/client_tls.rs

@@ -0,0 +1,12 @@
+//! Fresh test binary, no bootstrap: constructing the client must not panic
+//! for lack of a rustls CryptoProvider.
+use tmdb_enrichment::TmdbEnrichmentClient;
+
+#[test]
+fn tmdb_enrichment_builds_without_bootstrap() {
+    let cfg = config::MetadataConfig {
+        tmdb_api_key: Some("key".into()),
+        ..Default::default()
+    };
+    TmdbEnrichmentClient::from_config(&cfg).expect("client builds");
+}