[M5] mxaccess-asb-nettcp: M5 plan + F19 deps + F23 auth crypto port

F18 plans M5 as 9 sub-followups (F18-F26 + F27 constant-time DH) per
design/dependencies.md:73-89. Wave-1 streams F20-F23+F24 are parallel-safe
after F19 (workspace deps). F25 (ASB client) is sequential after the
framing/encoder streams. F26 (Session over AsbTransport) is sequential
after F25.

F19 — workspace deps for the M5 crypto + framing surface: hmac, md-5,
sha1, sha2, aes, cbc, pbkdf2, flate2, rand, num-bigint, num-traits,
num-integer, quick-xml, tokio-util, zeroize. Pinned to the digest 0.10 /
cipher 0.4 generation matching mxaccess-rpc.

F23 — ports `AsbSystemAuthenticator.cs` (167 LoC) to
`mxaccess-asb-nettcp::auth`. Wire-byte parity points: .NET BigInteger
little-endian two's-complement byte order with optional 0x00 sign-byte
suffix; AES-128-CBC with PKCS7 padding; PBKDF2-SHA1 1000 iterations
over `Convert.ToBase64String(crypto_key)` with ASCII salt
"ArchestrAService"; deflate-then-AES (Baktun) vs raw-AES (Apollo)
selected by `:V2` lifetime suffix; HMAC-MD5/SHA1/SHA512 negotiated per
`AsbSolutionCryptoParameters.HashAlgorithm` (with `force_hmac=true`
fallback to HMAC-SHA1 for unrecognised algorithms).

13 unit tests cover the cryptographic primitives + DH peer agreement +
.NET byte-order round-trip + Apollo lifetime dispatch.

F27 — filed for the `num-bigint` → `crypto-bigint::BoxedUint` swap once
the latter exposes a stable heap-allocated `pow_mod`. Currently at
parity with the .NET reference (also not constant-time).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rust/crates/mxaccess-asb-nettcp/src/lib.rs

@@ -1,7 +1,9 @@
 //! `mxaccess-asb-nettcp` — `[MS-NMF]` framing + `[MC-NBFX]/[MC-NBFS]` binary
 //! message encoding (the default `NetTcpBinding` encoder, **not** SOAP/XML).
 //!
-//! M0 stub. Real implementation lands in M5 — see `design/60-roadmap.md`.
+//! M5 work-in-progress — see `design/60-roadmap.md` and follow-up F18 in
+//! `design/followups.md` for the current sub-stream breakdown.
+//!
 //! The .NET reference at `src/MxAsbClient/MxAsbDataClient.cs:660-685` uses
 //! `new NetTcpBinding(SecurityMode.None)` with no encoder override, which
 //! selects `BinaryMessageEncodingBindingElement` by default.
@@ -11,5 +13,10 @@
 //!    plus the reliable-session ack handling on the underlying `net.tcp` channel.
 //! 2. `[MC-NBFX]` binary XML + `[MC-NBFS]` static dictionary that holds the
 //!    SOAP/WS-Addressing/`IASBIDataV2`-action strings.
+//!
+//! …plus an [`auth`] sub-module that ports the .NET `AsbSystemAuthenticator`
+//! (DH key exchange + HMAC signing + AES-128/PBKDF2-SHA1 derivation).
 
 #![forbid(unsafe_code)]
+
+pub mod auth;