TLS: OpenSSL nonblocking BIO + Std.Async readiness

[robertbetts]

Context

lean-grpc v1.3.0 addresses #10 with an off-loop model: blocking SSL_read / SSL_write / handshake run on dedicated threads (H2.runOffLoop / ofBlockingOffLoop) so the UV loop is not stalled. OpenSSL remains blocking FFI (SSL_set_fd).

Goal

True on-loop Async TLS: nonblocking sockets + OpenSSL SSL_ERROR_WANT_READ / WANT_WRITE integrated with Std.Async / libuv readiness (memory-BIO pump driven by Async TCP is an acceptable design).

Acceptance

• Documented nonblocking / event-driven TLS path (or explicit remaining caveats)
• mTLS / peerIdentity AuthN preserved
• CI coverage beyond off-loop smoke (asyncTlsLoopback)

Follow-up to #10 / PR #11. Sidecar (LEAN_GRPC_TLS_PROXY) stays complementary, not a substitute for in-process IAM.