Follow the sibling project's rename to dev-updater

It is no longer "local" -- it serves over WireGuard rather than the LAN --
and it is specifically for developing new apps. Renaming the references
here at the same time keeps one name to search for across both repos.

Also drops the last references to gen-dev-cert.sh, which the in-process
certificate generation replaced: the build script and the Gradle task now
say to start the server once, and test-wg-tunnel.sh reads the
certificates from the XDG directory rather than the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

app/androidApp/build.gradle.kts

@@ -6,7 +6,7 @@ plugins {
 
 // The CA this app pins is baked in at build time from the certificates on
 // the machine doing the build -- `$XDG_CONFIG_HOME/ai-app/certs/ca.pem`,
-// as written by ../gen-dev-cert.sh. AI_APP_CA overrides the path.
+// which the server generates on first start. AI_APP_CA overrides the path.
 //
 // Reading it rather than keeping a pasted copy in the source is what makes
 // the trust boundary follow the build: an APK built on the backend host
@@ -45,8 +45,8 @@ abstract class GeneratePinnedCert : DefaultTask() {
         if (!ca.isFile) {
             throw GradleException(
                 "No CA certificate at $path.\n" +
-                    "Run ./gen-dev-cert.sh on this machine first -- the app pins the CA it " +
-                    "generates, and the certificate has to exist before an APK can embed it.\n" +
+                    "Start ai-server once on this machine first -- it generates the CA the " +
+                    "app pins, and the certificate has to exist before an APK can embed it.\n" +
                     "Set AI_APP_CA=/path/to/ca.pem to build against a different one.",
             )
         }