feat: crypto library, Nexus HTTP server, JWT CLI, Boko web framework

- lib/crypto/: 9-module crypto library (Hash, HMAC, Base64/URL, Random, AES, RSA, ECDSA, Ed25519, JWT)
- rt/runtime.c: +346 lines OpenSSL crypto primitives (SHA-1/384/512, HMAC, Base64URL, AES-CBC/GCM, RSA, ECDSA, Ed25519)
- apps/nexus/: multi-threaded HTTP/1.1 + HTTP/2 detect + WebSocket server
- apps/jwt-pitbul/: JWT CLI tool (sign, verify, decode, keygen)
- apps/boko-framework/: FastAPI-inspired async web framework
- test_crypto/: crypto library test suite (23 tests)

lib/Crypto.bux

@@ -1,6 +1,19 @@
+// =============================================================================
+// Std::Crypto — backward-compatible wrapper (delegates to submodules)
+//
+// Migration note: new code should use the submodules directly:
+//   Std::Crypto::Hash::{Hash_Sha256, ...}
+//   Std::Crypto::Hmac::{Hmac_Sha256, ...}
+//   Std::Crypto::Base64::{Base64_Encode, Base64URL_Encode, ...}
+//   Std::Crypto::Random::{Random_Bytes, ...}
+//   Std::Crypto::Jwt::{Jwt_EncodeHS256, ...}
+// =============================================================================
 module Std::Crypto {
+
 import Std::Mem::{Alloc, Free};
 import Std::String::{String_Len};
+
+// Re-use the same externs from submodules (merged by compiler)
 extern func bux_sha256(data: String, len: int, out: *void);
 extern func bux_hmac_sha256(key: String, keylen: int, msg: String, msglen: int, out: *void);
 extern func bux_random_bytes(buf: *void, len: int) -> int;
@@ -8,7 +21,9 @@ extern func bux_base64_encode(data: String, len: int) -> String;
 extern func bux_base64_decode(data: String, len: int, outlen: *int) -> String;
 extern func bux_bytes_to_hex(data: *void, len: int) -> String;
 
-/* SHA-256: returns lowercase hex string of the hash */
+// --- Legacy function names (delegate to new submodule functions) ---
+
+// SHA-256 → hex
 func Crypto_Sha256(data: String) -> String {
     let len: int = String_Len(data) as int;
     let hashBuf: *void = Alloc(32);
@@ -18,7 +33,7 @@ func Crypto_Sha256(data: String) -> String {
     return result;
 }
 
-/* HMAC-SHA256: returns lowercase hex string */
+// HMAC-SHA256 → hex
 func Crypto_HmacSha256(key: String, message: String) -> String {
     let keylen: int = String_Len(key) as int;
     let msglen: int = String_Len(message) as int;
@@ -29,7 +44,7 @@ func Crypto_HmacSha256(key: String, message: String) -> String {
     return result;
 }
 
-/* Random bytes: returns a string of n random bytes */
+// Random bytes → base64
 func Crypto_RandomBytes(n: int) -> String {
     if n <= 0 { return ""; }
     let buf: *void = Alloc(n as uint);
@@ -42,12 +57,12 @@ func Crypto_RandomBytes(n: int) -> String {
     return result;
 }
 
-/* Base64 encode */
+// Base64 encode
 func Crypto_Base64Encode(s: String) -> String {
     return bux_base64_encode(s, String_Len(s) as int);
 }
 
-/* HMAC-SHA256 raw: returns base64 of raw binary hmac */
+// HMAC-SHA256 raw → base64
 func Crypto_HmacSha256Raw(key: String, message: String) -> String {
     let keylen: int = String_Len(key) as int;
     let msglen: int = String_Len(message) as int;
@@ -58,7 +73,7 @@ func Crypto_HmacSha256Raw(key: String, message: String) -> String {
     return result;
 }
 
-/* Base64 decode */
+// Base64 decode
 func Crypto_Base64Decode(s: String) -> String {
     let outlen: int = 0;
     return bux_base64_decode(s, String_Len(s) as int, &outlen);