docs: the CA travels in the enrol link, and why not the two alternatives

DECISIONS.md gets the decision with both rejected options and what the
longer link measures (89 -> 652 bytes, a 45x23 QR -> 93x47), RUST.md ticks
the enrolment queue item and marks the log-upload route superseded rather
than editing it, and IRIS.md says what changed for anyone building the
Android app.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/IRIS.md

@@ -1160,3 +1160,27 @@ and per-block-row work (RUST.md's "Verification pass over Tasks A and B").
   measured. With the counter it is a test: one delta into a 100-paragraph
   reply shapes exactly **1** text layout, the same as into a
   one-paragraph one.
+
+## 2026-09-07: the phone app is told which server to talk to, and pins from the link
+
+Not an iris API change -- a client-facing one, in the crates around it,
+worth knowing because it changes what a build of the Android app *is*.
+
+- **An iris APK is no longer tied to the machine that compiled it.** It
+  used to have the server's host, port, token and CA compiled in, which
+  made a build good for exactly one emulator/server pair and put a token
+  in the artifact. Now it registers `aiapp://enroll` like the Compose app:
+  open the link (Dev Updater's Enroll button already offers it, and the
+  phone asks which app should take it) and the app stores where to go and
+  what to trust.
+- **The CA rides in the link** as `&ca=<base64url DER>`, which is what
+  makes the above possible at all -- a pinned certificate cannot be baked
+  into an APK cross-compiled somewhere else. Optional, so the projects
+  that do build on their own machine keep the short link and the small QR.
+  docs/DECISIONS.md, 2026-09-07, has why not a fingerprint.
+- **`client_core::config` now holds the storage as well as the parsing**:
+  `EnrolledServer` gained an optional `ca_pem`, and `EnrollmentStore` (the
+  0600 JSON file, moved out of `desktop-app`) is one implementation for
+  both the desktop and the phone -- only the directory differs.
+  `desktop-app --ca` is now the override for a link that carried no CA
+  rather than a required flag.