ai-server --enroll-link: mint one more device's link while the server runs

Prints the enrollment URI, one line on stdout, and exits; the running
server adopts the token the first time that device presents it, via the
spool wg-app-link's enroll module now provides (submodule bumped to
d35c880). This is the server half of enrolling through Dev Updater: its
coming per-component Enroll button runs this command and opens whatever
it prints on the phone, which is what a reinstall -- a signing change, a
new phone -- needs when nobody is at the terminal the QR is printed on.

Verified against the sandbox server: minted while it ran, first request
with the token served and the token moved into config.ron, spool empty,
second request served as an ordinary token. 108 tests, clippy clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server/src/config.rs

@@ -295,6 +295,13 @@ pub const LOCAL_SETUP: &str = "this machine";
 /// a hand-written config can name it without looking one up.
 pub const LOCAL_SETUP_ID: &str = "local";
 
+/// Where `ai-server --enroll-link` leaves a token for the running server
+/// to adopt: beside the config, since it is config in transit. See
+/// `wg_app_link::enroll::spool_pending`.
+pub fn pending_enrollments_dir(config_path: &Path) -> PathBuf {
+    config_path.with_file_name("pending-enrollments")
+}
+
 impl Config {
     pub fn setup(&self, id: &str) -> Option<&SetupConfig> {
         self.setups.iter().find(|setup| setup.id == id)