ai-server --enroll-link: mint one more device's link while the server runs

Prints the enrollment URI, one line on stdout, and exits; the running
server adopts the token the first time that device presents it, via the
spool wg-app-link's enroll module now provides (submodule bumped to
d35c880). This is the server half of enrolling through Dev Updater: its
coming per-component Enroll button runs this command and opens whatever
it prints on the phone, which is what a reinstall -- a signing change, a
new phone -- needs when nobody is at the terminal the QR is printed on.

Verified against the sandbox server: minted while it ran, first request
with the token served and the token moved into config.ron, spool empty,
second request served as an ordinary token. 108 tests, clippy clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AGENTS.md

@@ -362,7 +362,10 @@ first if a remote spawn ever mangles an argument.
 - Run the server for development with `--bind 127.0.0.1`. Without it the
   server binds wg0, which exists here but is unreachable from the emulator
   (it dials 10.0.2.2). First run prints the enrollment QR/URI with the
-  token — capture it from the log.
+  token — capture it from the log. `ai-server --enroll-link` (same
+  `--config`/`--bind`/`--port`) mints one more device's link while the
+  server keeps running and prints only the URI; the server adopts that
+  token on its first use. It is what Dev Updater's Enroll button runs.
 - **`app/debug-transcript.sh` puts a real conversation on the emulator.**
   The echo driver stays the right rig for most things and is the wrong one
   for anything whose cost scales with what was actually written: a real