Let Dev Updater supervise the backend instead of shipping a script

dev-updater now carries a built-in service implementation, generated from
a template and driven through the identical interface a project-supplied
script uses, so a project whose service is unremarkable no longer writes
one. ai-app's was unremarkable: `ExecStart=$BINARY` and `command="$BINARY"`
with no arguments and no environment. 233 lines of it, and the half that
matters most -- the OpenRC branch, which neither project can exercise from
a systemd machine -- existed twice, so a fix found by testing would have
had two places to land and no way to notice the second.

The field keeps its name; `Managed` takes the command, resolved against
the component's `cwd`.

The one thing the script said that the built-in cannot is kept, in
AGENTS.md rather than lost: Stop on this card takes down the server a
phone reaches through the tunnel, while Dev Updater itself is unaffected
because it uses its own port -- which is exactly what makes that button
easy to press and easy to regret.

NOT SAFE TO PULL BLIND. A managed service is named after the component, so
this one becomes `app-backend` while the installed one still has the name
the script gave it. Uninstall from the backend card *before* taking this
change, then Install after; pulling first orphans a service that stays
enabled and starts at boot with nothing pointing at it.

.dev-updater.ron

@@ -18,9 +18,17 @@ components: [
         name: "backend",
         build: "cargo build --release",
         cwd: "server",
-        // Installs into whichever user-service manager is here, and is how
-        // ai-server is started, stopped and asked about. See the script.
-        service: "server/service",
+        // Dev Updater's own built-in service implementation, generated
+        // into its data directory and driven through the same interface a
+        // project-supplied script would be. ai-app carried a script of its
+        // own until 2026-08-28; it ran `target/release/ai-server` with no
+        // arguments and no environment, which is the generic case exactly,
+        // so it was two copies of one thing and the copy that could not be
+        // tested from here -- the OpenRC branch -- was duplicated with it.
+        //
+        // Resolved against this component's `cwd`, so this is
+        // `server/target/release/ai-server`.
+        service: Managed("target/release/ai-server"),
     ),
     Apk(
         name: "app",