nx_cms_tls_front.nx

nx_cms_tls_front.nx -- CMS C8: TLS-terminating FRONT for the CMS admin daemon (the sites-daemon integration shape, scoped to one backend). Speaks the SAME stack as nx_sites_daemon_v2: TLS 1.3 server session (Ed25519 CV -- the andelinwest/wiki daemon path), record-framed receive, chunked app_send (any response size). Each accepted connection: handshake -> read ONE request's plaintext -> forward over loopback TCP to the CMS admin -> relay the full response back inside TLS -> close. The admin stays loopback-only plain HTTP (single responsibility); THIS process owns the TLS boundary, exactly how the NAS sites daemon would adopt a CMS backend (route a vhost to a backend instead of static files). HONEST CONTRACT: request plaintext is taken up to CRLFCRLF reassembly (+ same-record body bytes); a body split into records AFTER the header record is not reassembled -- form posts from real browsers and our gates fit one record (<16KB). Named follow-on if uploads (C11) need more. argv: [1]=listen port [2]=backend port [3]=cert.der path [4]=ed25519 key path (32B) [5]=budget license_tier: ORIGINAL