nx_tls13_ext.nx

nx_tls13_ext.nx -- TLS 1.3 extension emitters + ServerHello parsers. Phase 0b §F.1 of the Nishi TLS 1.3 stack per docs/NISHI_TLS13_GAP_AUDIT.md. The byte-level emit functions for the 5 extensions a minimum-credible TLS 1.3 ClientHello MUST carry, plus parse functions for the two extensions a ServerHello echoes back (supported_versions + key_share). Per RFC 8446 §9.2: any TLS 1.3 ClientHello MUST contain supported_versions, supported_groups, key_share, and signature_algorithms. We add server_name (RFC 6066 §3) so we can talk to TLS-vhosted servers, and we make ALPN trivially extendable. Wire format per extension is: uint16 extension_type uint16 extension_data_length opaque extension_data[extension_data_length] What it does today: Client emit: - server_name (SNI, RFC 6066 §3, host_name only) - supported_versions client-variant TLS 1.3 only (§4.2.1) - supported_groups X25519 + secp256r1 (§4.2.7) - signature_algorithms ed25519 + rsa_pss_rsae_sha256 + rsa_pss_rsae_sha384 + ecdsa_secp256r1_sha256 (§4.2.3) - key_share client X25519 only (§4.2.8) Server parse: - supported_versions server-variant (single u16) (§4.2.1) - key_share server-variant (single KeyShareEntry) (§4.2.8) What it doesn't do yet: - ALPN emit/parse (queued; single-protocol case is trivial, multi-protocol needs a more general list helper) - psk_key_exchange_modes (queued with Gap M resumption) - pre_shared_key (queued with Gap M) - cookie (HRR path; queued with Gap G) - additional cert chain extensions (status_request, SCT) - additional named groups (P-384, P-521, Kyber, X25519+Kyber768) - additional signature schemes (ecdsa_secp384r1_sha384,