nx_tls13_server_session.nx

nx_tls13_server_session.nx -- TLS 1.3 SERVER session state + state machine. The inverse of nx_tls13_client_session. ===================================================================== SUPERIOR-CAPABILITY MOTIVATION (per the 2026-05-20 cardinal): The substrate already ships full TLS 1.3 CLIENT side (handshake + ALPN + record layer + auth) -- nishifamily.com fetches HTTPS today bits-up. But to SERVE nishifamily.com itself bits-up we need server-side handshake. No substrate currently does TLS 1.3 server in NishiLang; this file is the first stone. Per docs/NISHIFAMILY_COM_ALL_BITS_UP_STATUS_2026_05_20.md, TLS 1.3 server is the single biggest gap remaining for "all things bits-up on nishifamily.com." Once landed, Phase D-E of the master roadmap composes the shipped HTTP server + ACME + DNS + static-site-builder into a full sovereign HTTPS stack. ===================================================================== State machine (inverse of client; RFC 8446 §4): SSTATE_INIT -> SSTATE_CH_RECEIVED (peer ClientHello parsed) -> SSTATE_SH_SENT (we emitted ServerHello + key share) -> SSTATE_EE_SENT (EncryptedExtensions written) -> SSTATE_CERT_SENT (server Certificate) -> SSTATE_CV_SENT (CertificateVerify) -> SSTATE_SF_SENT (server Finished) -> SSTATE_CLIENT_FIN_RECV (peer Finished parsed + verified) -> SSTATE_CONNECTED (app data flow OK) Public API (this commit): struct Tls13ServerSession { /* see below */ } nx_tls13_server_session_new(server_random, server_x25519_priv) -> *Tls13ServerSession nx_tls13_server_state_is_valid(s) -> 0|1 Queued for next session (each its own commit, matching the client-session arc structure): nx_tls13_server_session_recv_ch parse ClientHello