ai-app: a phone interface to Claude Code and llama.cpp sessions

A Rust backend that owns the sessions and an Android app that reads them.
The server spawns and adopts CLI processes, normalises everything they emit
into one event model, keeps the transcript, and serves it over pinned TLS on
a WireGuard interface; the phone streams that, replies, sends images, and
imports conversations the machine already has.

`AGENTS.md` is the working guide -- what runs where, what has been measured,
and the faults that were expensive to find. `PLAN.md` is the design record.

History before this point was squashed away. It was a personal project's
running commentary and carried a name and a couple of machine paths that
have no business in a public repository; the tree is what mattered and the
tree is here.

app/androidApp/src/main/kotlin/com/example/aiapp/PinnedCert.kt

@@ -0,0 +1,18 @@
+package com.example.aiapp
+
+import com.example.wgapplink.PinnedTls
+import java.net.HttpURLConnection
+
+// PINNED_CA_PEM is generated at build time from the CA on the machine doing
+// the build -- see the generatePinnedCert task in build.gradle.kts. It is
+// deliberately not a checked-in constant: the private key that signs against
+// it must never be anywhere this repo is, and an APK should pin whatever CA
+// the backend it was built for actually serves.
+//
+// The pinning itself lives in wg-app-link, since dev-updater needs exactly
+// the same thing. What stays here is the one product-specific fact -- which
+// certificate this app pins.
+private val pinned = PinnedTls(PINNED_CA_PEM)
+
+/** Every request this app makes goes through this -- there is no unpinned path. */
+fun HttpURLConnection.applyPinnedTls() = pinned.applyTo(this)