App embeds the CA of the machine that builds it

PinnedCert.kt no longer carries a pasted certificate. The build reads
$XDG_CONFIG_HOME/ai-app/certs/ca.pem (AI_APP_CA overrides) and generates
the constant, so the trust anchor follows the build machine: an APK built
on the backend host pins that host, and one built in the dev VM pins the
VM's throwaway CA and is good only for its emulator.

That removes the reason to add a second trust anchor for development --
there is nothing to add and then forget to remove -- and it means the
private key never has to exist near this repo, which the VM can write.
Regenerating a CA now needs a rebuild instead of a paste, so a stale
constant can't quietly disagree with the server.

build-apk.sh is the missing counterpart to run-android.sh: it produces
the APK to install through Local Updater and touches no emulator. It
finds the SDK from ANDROID_HOME/ANDROID_SDK_ROOT before falling back to
~/Android/Sdk, since the host doesn't share the VM's layout, and prints
the fingerprint of the CA being pinned so a wrong one is visible there
rather than as a handshake failure on the phone.

Verified end to end on the emulator against a server using a freshly
generated CA -- which is how the first attempt was caught: the generated
constant began with a newline, so CertificateFactory lost the "-----BEGIN"
sniff, tried DER, and failed at runtime with an ASN.1 decode error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

gen-dev-cert.sh

@@ -129,14 +129,13 @@ echo "    CA fingerprint (base64):   $CA_SHA256"
 echo "    Leaf fingerprint (base64): $LEAF_SHA256"
 echo
 echo "    Only relevant if the CA was regenerated just now (i.e. ca.pem did"
-echo "    not already exist): the app embeds PINNED_CA_PEM and needs the new"
-echo "    $CERTS_DIR/ca.pem contents pasted in, or it silently"
-echo "    stops being able to reach this server. The app installs via Local"
-echo "    Updater, so recovery is a reinstall through that -- but it's still"
-echo "    a one-way door for the installed copy."
+echo "    not already exist): any app already installed pins the *previous*"
+echo "    CA and silently stops being able to reach this server. Rebuild and"
+echo "    reinstall it -- the APK embeds whatever ca.pem is here at build"
+echo "    time, so there is nothing to paste:"
 echo
-echo "      app/androidApp/src/main/kotlin/com/example/aiapp/PinnedCert.kt"
+echo "      ./app/build-apk.sh      # then install via Local Updater"
 echo
-echo "    Only ca.pem is meant to leave this machine. Copy it by hand; do not"
-echo "    put the certs directory back in the repo, which is shared with the"
-echo "    VM (see this script's header)."
+echo "    Nothing but ca.pem is meant to leave this machine, and it leaves"
+echo "    only by being compiled into an APK built here. Don't put this"
+echo "    directory in the repo, which is shared with the VM (see the header)."