Add live-server harness; centralise the rustls provider install

Adds a read-only example that exercises the connector against a real
Nextcloud: Login Flow v2, PROPFIND listing, the Depth:0 ETag pruning
probe, a 256KB range GET, and a server preview request. No PUT, MOVE or
DELETE, so it cannot alter a live library.

Running it against nextcloud.tourolle.paris (34.0.2) surfaced a real API
flaw rather than an example bug. The crypto provider was installed in
NextcloudBackend::new, but authentication necessarily runs *before* a
backend exists — so any caller following the documented flow panicked on
the first client build. Every entry point now goes through
`http_client()`, which installs the provider first, and auth gains
`begin_default()` for callers with no client yet. A test builds a client
without a backend to keep the regression out.

Also populates RawImage::crop from rawler's crop_area/active_area and
re-phases the CFA pattern when the crop origin is odd — cropping to the
active area without that swaps red and blue.

Login Flow v2 confirmed working against the live server: the flow URL is
issued and the poll endpoint responds. The remaining checks need a
browser approval, so they run interactively.

88 tests passing.

core/dr-sync-nextcloud/src/auth.rs

@@ -7,7 +7,7 @@
 use std::time::Duration;
 
 use dr_sync::RemoteError;
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 
 /// The flow's poll token is valid for 20 minutes.
 const FLOW_TIMEOUT: Duration = Duration::from_secs(20 * 60);
@@ -31,7 +31,7 @@ pub struct PollInfo {
 }
 
 /// Credentials issued at the end of the flow.
-#[derive(Debug, Clone, Deserialize)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AppCredentials {
     pub server: String,
     #[serde(rename = "loginName")]