Follow the sibling project's rename to dev-updater

It is no longer "local" -- it serves over WireGuard rather than the LAN --
and it is specifically for developing new apps. Renaming the references
here at the same time keeps one name to search for across both repos.

Also drops the last references to gen-dev-cert.sh, which the in-process
certificate generation replaced: the build script and the Gradle task now
say to start the server once, and test-wg-tunnel.sh reads the
certificates from the XDG directory rather than the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

PLAN.md

@@ -7,7 +7,7 @@ the official app gets wrong (e.g. it won't deliver a typed message until the
 session fully finishes its turn, where the TUI injects it at the next tool
 boundary).
 
-Same shape as `../local-updater`: a Rust (Axum) backend on the desktop, a
+Same shape as `../dev-updater`: a Rust (Axum) backend on the desktop, a
 Kotlin/Compose Android app, pinned self-signed TLS between them.
 
 ## The one idea everything hangs off
@@ -81,12 +81,12 @@ backend (Rust/Axum, desktop)
 
 ### Backend layout (`server/`)
 
-Mirroring local-updater's stack: axum 0.8, axum-server + rustls, tokio, serde,
+Mirroring dev-updater's stack: axum 0.8, axum-server + rustls, tokio, serde,
 clap, tracing. Rust edition 2024, warning-clean, clippy in CI habit.
 
 - `main.rs` — bootstrap, TLS listener.
 - `routes.rs` — the whole HTTP table in one module doc comment (as in
-  local-updater).
+  dev-updater).
 - `session/mod.rs` — `SessionManager`: the live session registry, every
   mutation funnels through it (the `registry.rs` pattern: in-memory and
   on-disk state can't come apart).
@@ -260,14 +260,14 @@ complete path out of everything spawning one created.
 ### Security
 
 - TLS with a self-signed CA, pinned in the app — same
-  idempotent-CA/reissued-leaf scheme as local-updater, same one-way-door
+  idempotent-CA/reissued-leaf scheme as dev-updater, same one-way-door
   caveat about regenerating the CA, but generated **in process on first
   start** (`certs.rs`) rather than by a shell script calling openssl
   (2026-08-25). One place then decides the extensions, the file modes, and
   which addresses the leaf covers — every local IPv4 plus loopback and the
   emulator's host alias, so nobody maintains a hardcoded IP — and there is
   no setup step to forget.
-  - Unlike local-updater, the pinned CA is **not a constant in the source**:
+  - Unlike dev-updater, the pinned CA is **not a constant in the source**:
     the build reads `$XDG_CONFIG_HOME/ai-app/certs/ca.pem` from the machine
     doing the build and generates the constant (`generatePinnedCert` in
     `app/androidApp/build.gradle.kts`; `AI_APP_CA` overrides). Decided
@@ -392,12 +392,12 @@ complete path out of everything spawning one created.
     a deliberate flag, never a fallback, so the fail-closed default is
     untouched (2026-08-24).
 - The bootstrap-over-HTTP trick from the updater is unnecessary here — the
-  app installs via Local Updater.
+  app installs via Dev Updater.
 
 ## App (`app/`)
 
 Kotlin + Compose Multiplatform, single `:androidApp` module, same versions as
-local-updater (Kotlin 2.4.x, CMP 1.11.x, JDK 21). Screens:
+dev-updater (Kotlin 2.4.x, CMP 1.11.x, JDK 21). Screens:
 
 1. **Session list** — cards: kind icon, title, host, model, status
    (running / awaiting answer / idle / exited), last activity. Spawn FAB;
@@ -420,7 +420,7 @@ local-updater (Kotlin 2.4.x, CMP 1.11.x, JDK 21). Screens:
 5. **Settings** — server address + token, hosts editor, llama model list
    editor.
 
-Networking mirrors local-updater's app layer (`AppsApi.kt` style thin client +
+Networking mirrors dev-updater's app layer (`AppsApi.kt` style thin client +
 pinned transport), plus an SSE client with `after=` resume driven by
 connectivity/lifecycle. The app keeps no persistent transcript store — the
 backend's transcript is the source of truth; the app caches only for the
@@ -501,7 +501,7 @@ window just fills.
 Each phase ends runnable and verified against the real thing (rule 22); the
 backend gets tests where logic is pure (event normalization, transcript
 cursors, config persistence, refcounting) — the app is UI over the API and is
-verified by running it, matching local-updater's posture.
+verified by running it, matching dev-updater's posture.
 
 ## Open questions / risks
 
@@ -539,6 +539,6 @@ installed versions when each phase starts):
   ≥180 s polling; wrong User-Agent → aggressive 429 bucket):
   https://github.com/anthropics/claude-code/issues/31637 and
   https://github.com/Maciek-roboblog/Claude-Code-Usage-Monitor/issues/202
-- Sibling project this repo's conventions mirror: `../local-updater`
+- Sibling project this repo's conventions mirror: `../dev-updater`
   (README.md + AGENTS.md — server/registry/routes layout, cert scheme,
   testing posture, Android env notes).