Follow the sibling project's rename to dev-updater

It is no longer "local" -- it serves over WireGuard rather than the LAN --
and it is specifically for developing new apps. Renaming the references
here at the same time keeps one name to search for across both repos.

Also drops the last references to gen-dev-cert.sh, which the in-process
certificate generation replaced: the build script and the Gradle task now
say to start the server once, and test-wg-tunnel.sh reads the
certificates from the XDG directory rather than the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

app/build-apk.sh

@@ -1,16 +1,17 @@
 #!/bin/sh
-# Builds the app's APK, ready to install on a phone through Local Updater.
+# Builds the app's APK, ready to install on a phone through Dev Updater.
 #
 #   ./build-apk.sh
 #
 # The APK pins the CA on *this* machine ($XDG_CONFIG_HOME/ai-app/certs/ca.pem,
 # or AI_APP_CA), so build it on the machine that runs the backend: an app
 # built somewhere else trusts a CA that backend can't present, and simply
-# won't connect. Run ../gen-dev-cert.sh first if there are no certificates
-# yet; the build stops with that instruction if it can't find one.
+# won't connect. Start ai-server once first if there are no certificates
+# yet -- it generates them; the build stops with that instruction if it
+# can't find one.
 #
 # Unlike ./run-android.sh, this touches no emulator: it only produces the
-# file. Installing on a real phone goes through Local Updater, which serves
+# file. Installing on a real phone goes through Dev Updater, which serves
 # whatever is under this project's build directory.
 set -eu
 
@@ -41,7 +42,7 @@ CA="${AI_APP_CA:-${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/certs/ca.pem}"
 if [ -f "$CA" ]; then
     # Printed so a wrong or stale certificate is visible here rather than as
     # a handshake failure on the phone. Compare with the server's own
-    # ca-sha256.txt, which gen-dev-cert.sh writes beside it.
+    # the CA the server is actually presenting.
     FINGERPRINT=$(openssl x509 -in "$CA" -pubkey -noout 2>/dev/null \
         | openssl pkey -pubin -outform der 2>/dev/null \
         | openssl dgst -sha256 -binary 2>/dev/null \
@@ -49,8 +50,8 @@ if [ -f "$CA" ]; then
     echo "==> Pinning the CA at $CA"
     echo "    fingerprint: $FINGERPRINT"
 else
-    echo "No CA certificate at $CA -- run ../gen-dev-cert.sh on this machine" >&2
-    echo "first, or set AI_APP_CA to one. The APK has to embed it at build time." >&2
+    echo "No CA certificate at $CA -- start ai-server once on this machine" >&2
+    echo "(it generates them), or set AI_APP_CA. The APK embeds it at build time." >&2
     exit 1
 fi
 
@@ -62,7 +63,7 @@ echo
 echo "==> Built $APK"
 [ -f "$APK" ] && ls -lh "$APK" | awk '{print "    " $5}'
 echo
-echo "To get it onto the phone: add this project to Local Updater (or hit"
+echo "To get it onto the phone: add this project to Dev Updater (or hit"
 echo "Update on it if it's already there) and install from there."
 echo "Then start the backend and scan the enrollment QR it prints:"
 echo "    ./server/target/release/ai-server --rotate-token"