fix(protocol,audio,ios): native-tls instead of rustls+aws-lc-rs

Building the bridge for `aarch64-apple-ios` failed in two ways with
the previous TLS stack:

  1. `aws-lc-sys` (transitive: rustls -> aws-lc-rs -> aws-lc-sys)
     does not cross-compile cleanly to iOS — the build produced
     undefined symbols for architecture arm64 (mldsa44, ec_GFp_mont,
     etc).
  2. `audiopus_sys` linked against the wrong iOS runtime version,
     missing `___chkstk_darwin`.

Following the rustls-platform-verifier docs and the standard Rust+
iOS+TLS pattern used by 1Password / Signal / rustup / Bitwarden,
this commit swaps the TLS provider to **native-tls** so each
platform picks its own:

  * macOS + iOS  -> Security.framework (no external C deps)
  * Windows      -> SChannel
  * Linux/BSD    -> system OpenSSL

Changes:

crates/chanora_protocol/Cargo.toml
crates/chanora_audio/Cargo.toml
  * Drop `default-tls` from tsclientlib's features. The remaining
    `audio` feature is what we actually use; default-tls was a
    reqwest convenience that picked rustls+aws-lc-rs.
  * Add a direct `reqwest` dep with `default-features = false,
    features = ["charset", "http2", "native-tls"]`. Cargo's
    workspace feature unification carries this through the
    transitive `tsclientlib -> reqwest` chain.

apps/chanora_flutter/ios/Podfile
  * Uncomment `platform :ios, '13.0'` so CocoaPods stops emitting
    the implicit-platform warning and Xcode's iOS deployment-
    target check is honored.

apps/chanora_flutter/ios/Podfile.lock
  * Generated by `pod install` after the platform pin. Committed so
    iOS builds on other developer machines pull the exact same Pod
    versions.

apps/chanora_flutter/ios/Runner.xcodeproj/project.pbxproj
apps/chanora_flutter/ios/Runner.xcworkspace/contents.xcworkspacedata
  * CocoaPods auto-integration: adds Pods_Runner.framework +
    Pods_RunnerTests.framework references and the Pods xcconfig
    file references. Standard `pod install` output; reviewing the
    diff shows only Pod-bookkeeping additions, no signing or
    target-config drift.

Verified end-to-end on the M1 Mac (coder@100.118.130.73):
  cargo build --release -p chanora_bridge                29.09 s
  cargo build --release --target aarch64-apple-ios       24.32 s
    (with IPHONEOS_DEPLOYMENT_TARGET=13.0 and
     CMAKE_POLICY_VERSION_MINIMUM=3.5 in the env to satisfy the
     audiopus_sys cmake invocation; documented as a P1 build-glue
     follow-up.)
  flutter build ios --release --no-codesign              ok
    Built build/ios/iphoneos/Runner.app (16.9 MB)
  Xcode GUI build of Runner.xcworkspace                  ok
    (after the user opened Runner.xcworkspace, NOT
     Runner.xcodeproj, and Clean Build Folder.)

Tests on macOS unchanged: chanora_audio 34 / 0 / 0.

DEC-025: iOS + macOS officially in scope for P0.

crates/chanora_audio/Cargo.toml

@@ -23,7 +23,17 @@ audiopus = "0.3.0-rc.0"
 # AudioHandler lives in the tsclientlib crate behind the `audio`
 # feature. We import the crate just for the AudioHandler type; the
 # Connection type stays inside chanora_protocol.
-tsclientlib = { git = "https://github.com/ReSpeak/tsclientlib.git", rev = "04aa2491", default-features = false, features = ["default-tls", "audio"] }
+tsclientlib = { git = "https://github.com/ReSpeak/tsclientlib.git", rev = "04aa2491", default-features = false, features = ["audio"] }
+# Force the reqwest TLS backend to native-tls (Security.framework on
+# Apple, SChannel on Windows, system OpenSSL on Linux/BSD) instead of
+# the rustls + aws-lc-rs combination tsclientlib's `default-tls`
+# feature would otherwise pick. aws-lc-sys does not cross-compile
+# cleanly to aarch64-apple-ios, and native-tls is the standard
+# answer for "TLS that just works on every desktop+mobile platform
+# without a vendored C dependency". Cargo's feature unification means
+# this single direct dep applies to the transitive
+# tsclientlib -> reqwest chain too.
+reqwest = { version = "0.13", default-features = false, features = ["charset", "http2", "native-tls"] }
 
 tokio = { version = "1", features = ["sync", "rt", "macros", "time"] }
 

crates/chanora_protocol/Cargo.toml

@@ -18,7 +18,17 @@ once_cell = "1"
 # tsclientlib is git-only and not on crates.io. The "audio" feature
 # pulls in `audiopus` only — `sdl2` is a dev-dep used by upstream
 # examples; the library itself does not link SDL.
-tsclientlib = { git = "https://github.com/ReSpeak/tsclientlib.git", rev = "04aa2491", default-features = false, features = ["default-tls", "audio"] }
+tsclientlib = { git = "https://github.com/ReSpeak/tsclientlib.git", rev = "04aa2491", default-features = false, features = ["audio"] }
+# Force the reqwest TLS backend to native-tls (Security.framework on
+# Apple, SChannel on Windows, system OpenSSL on Linux/BSD) instead of
+# the rustls + aws-lc-rs combination tsclientlib's `default-tls`
+# feature would otherwise pick. aws-lc-sys does not cross-compile
+# cleanly to aarch64-apple-ios, and native-tls is the standard
+# answer for "TLS that just works on every desktop+mobile platform
+# without a vendored C dependency". Cargo's feature unification means
+# this single direct dep applies to the transitive
+# tsclientlib -> reqwest chain too.
+reqwest = { version = "0.13", default-features = false, features = ["charset", "http2", "native-tls"] }
 
 # tsproto_packets exposes OutAudio / InAudioBuf / AudioData /
 # CodecType / Direction. Pinning to the same git rev as tsclientlib