Phase 1 server: TLS + token auth, session registry, EchoDriver, SSE with cursors

The whole pipe behind one Driver trait and a common event model:
spawn/list/delete sessions, message + question answering, append-only
JSONL transcripts whose sequence numbers are the phone's resume cursor
(surviving backend restarts), bearer-token middleware wrapping every
route including the fallback, wg0-only binding that fails closed, and
first-run token enrollment via a terminal QR.

Verified: cargo test (10), clippy clean, and curl end-to-end over pinned
TLS -- auth rejection, spawn, streamed SSE replay/resume, /question
round trip, restart continuing seq numbers, delete removing everything.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

.gitignore

@@ -0,0 +1,20 @@
+.gradle/
+build/
+app/androidApp/build/
+local.properties
+.kotlin/
+*.iml
+.idea/
+.DS_Store
+server/target/
+server/ai-server.log
+
+# Private key material, regenerated by ./gen-dev-cert.sh.
+certs/
+
+# Machine-local state: token hashes and the session list. Nothing here is
+# shareable, and the token hashes shouldn't be.
+config.json
+
+# Per-session transcripts, attachments, and produced images.
+sessions/