Phase 1 server: TLS + token auth, session registry, EchoDriver, SSE with cursors

The whole pipe behind one Driver trait and a common event model:
spawn/list/delete sessions, message + question answering, append-only
JSONL transcripts whose sequence numbers are the phone's resume cursor
(surviving backend restarts), bearer-token middleware wrapping every
route including the fallback, wg0-only binding that fails closed, and
first-run token enrollment via a terminal QR.

Verified: cargo test (10), clippy clean, and curl end-to-end over pinned
TLS -- auth rejection, spawn, streamed SSE replay/resume, /question
round trip, restart continuing seq numbers, delete removing everything.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

run-tests.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Runs this repo's tests. Extra arguments are forwarded to `cargo test`,
+# e.g. `./run-tests.sh transcript` to run just the transcript tests.
+#
+# Only `server/` has tests: it holds all the logic worth testing (event
+# normalization, transcript cursors, config persistence, token auth), while
+# the Android app is UI over its HTTP API. Verifying the app means running
+# it -- see AGENTS.md.
+set -eu
+cd "$(dirname "$0")/server"
+exec cargo test "$@"