Take the link from wg-app-link instead of keeping a second copy

The five modules underneath this backend that were never about AI
sessions -- the pinned CA and leaf, QR enrollment and the bearer token,
wg0 binding and the certificate's SANs, owner-only files, and the RON
house rules -- were written twice, once here and once in dev-updater,
and had drifted. They now come from the submodule, as a path dependency
so both projects stay locked to one commit.

What stayed is what makes this project itself: the routes, the drivers,
the config schema, and the auth middleware, which is generic over this
server's state. Sharing a transport is worth doing; sharing an API would
mean inventing a vocabulary neither project wants.

Four dependencies go with the code -- rcgen, qrcode, subtle and if-addrs
are no longer named here at all -- and the three that remain are now
described by what still uses them rather than by what used to.

Verified by running it, not only by building: a fresh server generates
its CA, prints an `aiapp://enroll` QR with the scheme now passed as a
parameter, covers 127.0.0.1, 10.0.2.2 and wg0's 10.66.0.1 in the leaf,
answers an enrolled token and returns 401 without one, and writes
config.ron in the house rules with every file owner-only. 36 tests pass,
clippy is silent, rustfmt is clean.

server/Cargo.lock

@@ -26,16 +26,12 @@ dependencies = [
  "axum-server",
  "base64 0.23.1",
  "clap",
- "if-addrs",
- "qrcode",
  "rand",
- "rcgen",
  "ron",
  "rustls",
  "serde",
  "serde_json",
  "sha2",
- "subtle",
  "tempfile",
  "thiserror",
  "tokio",
@@ -44,6 +40,7 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "ureq",
+ "wg-app-link",
 ]
 
 [[package]]
@@ -1868,6 +1865,23 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "wg-app-link"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.23.1",
+ "if-addrs",
+ "qrcode",
+ "rand",
+ "rcgen",
+ "ron",
+ "serde",
+ "sha2",
+ "subtle",
+ "tracing",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"