C-compatible FFI bindings.
Thin wrapper around the public API. Opaque pointers. No Rust types exposed.