feat(tls): add TLS provider initialization and integrate with van-weather

rust/tls/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "tls"
+version = "0.1.0"
+edition = "2024"
+description = "Shared AWS-LC TLS provider initialization"
+license = "MIT"
+publish = false
+
+[dependencies]
+anyhow.workspace = true
+rustls.workspace = true
+
+[lints]
+workspace = true

rust/tls/src/lib.rs

@@ -0,0 +1,16 @@
+//! Shared TLS configuration for workspace applications.
+
+use anyhow::{Result, anyhow};
+
+/// Install AWS-LC as the process-wide default TLS crypto provider.
+///
+/// Call once at startup, before creating HTTP clients.
+///
+/// # Errors
+///
+/// Returns an error if a TLS crypto provider has already been initialized.
+pub fn install_tls_provider() -> Result<()> {
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .map_err(|_| anyhow!("TLS crypto provider was already initialized"))
+}