Keep state and keys out of the shared repo

The dev VM is treated as untrusted, and the repo is a read-write virtiofs
mount shared with the backend host -- so a CA private key sitting in it is
a key that machine can sign with, and a leaf signed by this CA is one the
phone's pinned app accepts without question. Pinning against a CA the
attacker holds is no pinning at all.

So certificates are now generated on the machine that serves them, into
$XDG_CONFIG_HOME/ai-app/certs at 0700 with 0600 keys (AI_APP_CERTS
overrides), and config.json and session transcripts move to the XDG config
and data directories. Transcripts move for a plainer reason than the keys:
they are whole conversations, and they were world-readable at 0644.

Two smaller things fall out. The host and VM stop sharing one config,
which had already put a test token on the production backend. And state
stops living where `git clean -xdf` would take the enrollment and every
transcript with it.

State that predates the move is still read from the repo, with a warning
naming where to move it, so an existing install keeps working rather than
silently coming up on an empty config -- the precedence is covered by a
test, since picking the wrong file would otherwise be silent.

Verified: 31 tests, clippy clean; the certificate script writing 0700/0600
into an overridden directory; and the server logging the fallback and
serving from it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

AGENTS.md

@@ -106,10 +106,19 @@ Established 2026-08-25, and it decides more than it looks like:
   configured host, and a session that names it. For the host to ssh in,
   the VM needs an inbound port forward in its launch configuration
   (qemu `hostfwd`) — usermode networking has none by default.
-- **`config.json` is shared with the host too**, so it is the *production*
-  config: don't leave test tokens or throwaway hosts in it. Point
-  development at a scratch one instead:
-  `--config /tmp/…/config.json --data-dir /tmp/…/sessions --port 8444`.
+- **Nothing secret goes in the repo.** The VM is treated as untrusted (see
+  PLAN.md's security section), and the repo is shared read-write with the
+  host, so state lives outside it: `$XDG_CONFIG_HOME/ai-app/config.json`
+  and `certs/`, `$XDG_DATA_HOME/ai-app/sessions/`, owner-only. The server
+  still reads a pre-move `config.json`/`sessions/` from the repo, with a
+  warning, so an old install keeps working.
+- Certificates are generated **on the machine that serves them**
+  (`./gen-dev-cert.sh`, honours `AI_APP_CERTS`). Running it in the VM makes
+  a separate throwaway dev CA for emulator work — never install a build
+  pinning that on the real phone.
+- Point development at a scratch state directory rather than the real one:
+  `--config /tmp/…/config.json --data-dir /tmp/…/sessions --port 8444`, or
+  `XDG_CONFIG_HOME=… XDG_DATA_HOME=…`.
 
 ## Things that have bitten