nx_mtls_test_daemon.nx

nx_mtls_test_daemon.nx -- the mTLS INTEROP test daemon: proves run_ecdsa_mtls completes a real TLS 1.3 MUTUAL-auth handshake against a STANDARD client (openssl s_client / curl / a browser), and that run_ecdsa_mtls VERIFIES the client cert that the standard client presents. This is the byte-level interop the loopback gate cannot cover (the loopback proves the LOGIC against our own message construction; THIS proves the wire format is correct against OpenSSL/Schannel/BoringSSL). It is the de-risk gate before the live doc-wall cutover. NOT a live daemon -- a throwaway harness. Adapted from nx_tls13_ed25519_test_daemon (the proven server-auth interop pattern) by swapping run_ed25519 -> run_ecdsa_mtls and logging the client-auth result. FLOW: read ECDSA server cert+key (the demo P-256 cert) -> bind 127.0.0.1:7444 -> accept ONE conn -> run_ecdsa_mtls (sends CertificateRequest; reads + verifies the client's Certificate+CertificateVerify+Finished) -> LOG auth result + the verified identity -> send a tiny HTTP body -> exit. COMPOSES (sovereign): nx_csprng + nx_http_server + nx_tls13_server_session_run_mtls + app_send + nx_mtls_authz.