fn forward_client() -> Result<&'static Client>
One shared WebPKI-hardened client for every authenticated forward so the root store is built once per process instead of per call.