nx_tls13_app_send_fd.nx

nx_tls13_app_send_fd.nx -- chunked TLS 1.3 application-data send to an fd. ROOT CAUSE this fixes: nx_tls13_server_session_app_send encrypts the WHOLE payload as ONE record, but RFC 8446 §5.1 caps record plaintext at 2^14 (16384) bytes -- compliant clients MUST abort with record_overflow on anything bigger. The hosting path therefore could not serve any asset over ~16.3KB (the /video page is 19KB, its JS ~35KB). This module splits the payload into <=NX_TLS13_SENDFD_CHUNK-byte records and writes each to the fd, handling partial writes. One reusable record buffer, supplied by the caller (constant-memory daemons hoist it once). Composes nx_tls13_server_session_app_send (KAT'd record build) -- the per-record path is UNCHANGED, so existing small-response behaviour is byte-identical (API contract stability: additive, nothing renamed). Gate: nx_tls13_app_send_fd_gate.nx (fabricated CONNECTED session with fixed keys -> 40KB payload -> records to a file -> decrypt each record with nx_tls13_record_decrypt_v2 -> reassembled plaintext byte-compares). license_tier: ORIGINAL