- Update server and runner to use X25519MLKEM768 kx group from aws_lc_rs
- Both --mode x25519 and --mode x25519mlkem768 now work
- Integration tested end-to-end with both modes
- Generate self-signed certificates on startup using rcgen
- Configure rustls with aws_lc_rs crypto provider
- Filter key exchange groups to X25519-only for mode=x25519
- Print CA certificate for client trust configuration
- TLS 1.3 protocol enforced
- CaCertificate: self-signed CA that can sign server certificates
- ServerCertificate: DER-encoded cert chain and private key
- generate_test_certs(): convenience helper for local testing
- Uses rcgen 0.14 for X.509 certificate generation