nx_https_fetch_lib.nx

nx_https_fetch_lib.nx -- the sovereign HTTPS GET composition, as a LIBRARY. WHY THIS EXISTS (2026-07-31): the whole working fetch path -- trust-store load, CSPRNG, url parse, connect (with optional override), TLS 1.3 chrome-JA3 handshake, cert cache, path+query assembly, HTTP GET -- lived inside nx_https_get_cli.nx's main(). Any second consumer (the album downloader) had exactly two bad options: duplicate ~90 lines of crypto setup, or shell out. Rule 15: a pattern needed by more than one consumer belongs in a lib, and duplicated crypto setup is the kind that diverges SILENTLY -- one copy gets the cert-cache fix or the recv_hs reassembly fix and the other quietly does not. The logic here is LIFTED VERBATIM from the proven CLI, only parameterised. The CLI is then re-pointed at this lib so there is ONE implementation, and its behaviour is re-verified live after the move (a refactor of a crown-jewel path is not done until the old entry point is proven still working). ★ THE STORE IS LOADED SEPARATELY ON PURPOSE. nx_trust_store_load_from_certdata parses a ~4 MiB Mozilla bundle. Doing that per file would make a 300-file album pay it 300 times. hf_store_load() once, then hf_fetch() per url. license_tier: ORIGINAL