qbzd: install the rustls process-level CryptoProvider

The rustls crypto provider was not installed for `qbzd`, which caused the
process to panic:

> thread 'tokio-rt-worker' (15737) panicked at [...]/rustls-0.23.37/src/crypto/mod.rs:249:14:
>
> Could not automatically determine the process-level CryptoProvider from
> Rustls crate features.
> Call CryptoProvider::install_default() before this point to select a
> provider manually, or make sure exactly one of the 'aws-lc-rs' and 'ring'
> features is enabled.
> See the documentation of the CryptoProvider type for more information.

The function `ensure_crypto_provider()` was defined in the `qbz-cast` crate
which is obviously not a dependency of `qbzd`.

This commit moves `ensure_crypto_provider()` to `qbz-app`, calls it from `qbzd`
and updates `qbz` accordingly.

crates/qbz-app/src/lib.rs

@@ -10,3 +10,20 @@ pub mod session_store;
 pub mod shell;
 pub mod settings;
 pub mod user_data;
+
+/// Install the rustls process-level `CryptoProvider` (aws-lc-rs) exactly once.
+///
+/// Idempotent (a second call is a no-op); harmless if some other component
+/// already installed a default (`install_default` then returns Err, ignored).
+pub fn ensure_crypto_provider() {
+    use std::sync::Once;
+    static INIT: Once = Once::new();
+    INIT.call_once(|| {
+        if rustls::crypto::aws_lc_rs::default_provider()
+            .install_default()
+            .is_err()
+        {
+            log::debug!("[app] rustls CryptoProvider already installed");
+        }
+    });
+}