Put the service script back until the switch can be sequenced

Reverts the switch to `service: Managed(...)`. The switch is still right
and the reasoning in that commit still holds; what was wrong was doing it
now, unilaterally, to a checkout something is reading live.

A dev-updater is running against this working tree, so deleting
`server/service` did not wait for a pull to take effect -- the backend
card went to "couldn't check -- failed to run the service script: No such
file or directory" immediately, and the pushed declaration still names the
script, so the tree and the declaration disagreed in the one direction
that breaks things. My own commit message had said this change was not
safe to pull blind; it turned out not to need a pull at all.

The switch needs three steps in order, and only the middle one is mine:
Uninstall from the backend card while the script is still declared, then
take the change, then Install. Re-apply when Iris is ready to do that,
which is also when dev-updater's conversion path can be deleted.

AGENTS.md

@@ -48,21 +48,10 @@ repo is in PLAN.md's "Backend layout" section.
   event model mirror; `ServerConfig.kt` settings + Keystore-sealed token;
   screens in `SessionListScreen/SessionScreen/SpawnScreen/SettingsScreen`.
 - `.dev-updater.ron` — what Dev Updater is asked to do with this checkout:
-  the backend (built in `server/`, run as `service: Managed(...)`) and then
-  the APK (built in `app/`), in that order. The project it serves is the
-  repository, not either half of it, which is why this sits at the root
-  rather than in `app/`.
-  `Managed` means Dev Updater supervises `ai-server` with its own built-in
-  service implementation rather than a script kept here. ai-app had such a
-  script until 2026-08-28 and it was the generic case exactly — no
-  arguments, no environment — so the two projects were maintaining one
-  behaviour twice, including the OpenRC branch neither can test from a
-  systemd machine.
-  Worth knowing before pressing it: **Stop** on the backend card stops the
-  server that a phone reaches through the tunnel, so on that phone it stays
-  down until someone starts it again from Dev Updater. Dev Updater reaches
-  it over its own port and is unaffected, which is what makes the button
-  safe to press and easy to regret.
+  the backend (built in `server/`, installed and controlled through
+  `server/service`) and then the APK (built in `app/`), in that order. The
+  project it serves is the repository, not either half of it, which is why
+  this sits at the root rather than in `app/`.
 - `wg-app-link/` — a **git submodule**, and the half of this backend that
   dev-updater also needed: the pinned CA and leaf (`certs`), QR enrollment
   and the bearer token (`enroll`), wg0 binding and the certificate's SANs