ai-server --enroll-link: mint one more device's link while the server runs

Prints the enrollment URI, one line on stdout, and exits; the running
server adopts the token the first time that device presents it, via the
spool wg-app-link's enroll module now provides (submodule bumped to
d35c880). This is the server half of enrolling through Dev Updater: its
coming per-component Enroll button runs this command and opens whatever
it prints on the phone, which is what a reinstall -- a signing change, a
new phone -- needs when nobody is at the terminal the QR is printed on.

Verified against the sandbox server: minted while it ran, first request
with the token served and the token moved into config.ron, spool empty,
second request served as an ordinary token. 108 tests, clippy clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server/src/session/mod.rs

@@ -825,6 +825,21 @@ impl SessionManager {
         Ok(())
     }
 
+    /// Adds one enrolled device, keeping the others -- the other half of
+    /// [`Self::set_tokens`], which replaces them all.
+    pub fn add_token(&self, token: TokenEntry) -> Result<()> {
+        let mut inner = self.inner.write().unwrap();
+        let mut candidate = inner.config.clone();
+        candidate.tokens.push(token);
+        candidate.save(&self.config_path)?;
+        inner.config = candidate;
+        Ok(())
+    }
+
+    pub fn pending_enrollments_dir(&self) -> PathBuf {
+        crate::config::pending_enrollments_dir(&self.config_path)
+    }
+
     /// Lets go of every session's process, for a server that is going
     /// away and means to adopt them again when it comes back.
     ///