fix: ensure rustls crypto provider is installed in TactClient

TactClient::new creates a reqwest::Client directly, bypassing the
HttpClient transport layer which calls ensure_crypto_provider(). This
caused "No provider set" panics in tests and code coverage CI.

Make ensure_crypto_provider() pub(crate) and call it from TactClient::new.

Author: danielsreichenbach

crates/cascette-protocol/src/client/tact.rs

@@ -21,6 +21,7 @@ impl TactClient {
     /// Create a new TACT client
     #[cfg(not(target_arch = "wasm32"))]
     pub fn new(base_url: String, _use_https: bool) -> Result<Self> {
+        crate::transport::ensure_crypto_provider();
         let client = Client::builder()
             .pool_idle_timeout(Duration::from_secs(90))
             .pool_max_idle_per_host(10)

crates/cascette-protocol/src/transport/mod.rs

@@ -15,7 +15,7 @@ use std::time::Duration;
 /// Uses ring as the crypto provider. If another provider was already installed
 /// (e.g. by the application), this is a no-op.
 #[cfg(not(target_arch = "wasm32"))]
-fn ensure_crypto_provider() {
+pub(crate) fn ensure_crypto_provider() {
     // OnceLock ensures we only attempt installation once.
     // install_default() returns Err if a provider is already set, which we ignore.
     static INIT: OnceLock<()> = OnceLock::new();