pub fn build_client( ca_cert: Option<&Path>, client_cert: Option<&Path>, client_key: Option<&Path>, ) -> Result<Client>
TLS-only mode (None cert/key) supported but production always wires both.