nx_device_cert.nx

nx_device_cert.nx -- DEVICE provisioning for the access wall (the "provision certain devices to certain areas even over the internet" layer, L3). A provisioned device = (device_id, ed25519 PUBLIC key) in the registry; the device holds the matching PRIVATE key. To access, the device signs a FRESH server challenge (nonce) with its private key; the server verifies the signature against the registered public key -> the device_ok signal the PDP (nx_access_wall) consumes. Spoof-proof (no private key => no valid signature), replay-resistant (fresh challenge), and works over the public internet -- the mTLS essence without a shared secret. Does NOT roll crypto: reuses the KAT-verified ed25519 (ed25519_verify_full, RFC 8032). license_tier: ORIGINAL