Say what the code actually does, in the three places that had drifted

A doc comment is not compiled, so nothing catches one that has outlived
what it described. `cargo doc` does catch a subset, and it was failing:
three unresolved intra-doc links in config.rs, all mine from today -- two
naming `parse`/`render` from outside the module that defines them, and one
`format` that is ambiguous with the macro. Rustdoc now runs clean with
broken_intra_doc_links denied.

auth.rs's module doc pointed at a test called `token_is_never_logged`,
which no longer exists: it was folded into the combined gating+logging test
because tracing caches callsite interest process-wide. The doc now
describes the test that is there and says why it is one test.

AGENTS.md contradicted itself twice, both checked against a running server
rather than by reading. Its curl example passed `--cacert certs/ca.pem`, a
path relative to the checkout, while the bullet above it correctly says the
CA is generated under $XDG_CONFIG_HOME -- so the documented command fails
before it connects; with the real path it returns `[]`. And it said wg0
"doesn't exist on this machine yet" as the reason for --bind 127.0.0.1,
which the section below it already contradicts: wg0 is up at 10.66.0.1, and
the actual reason is that the emulator dials 10.0.2.2 and cannot reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

AGENTS.md

@@ -75,11 +75,15 @@ real-phone/WireGuard bring-up, which is operational rather than code.
   generated into a constant. So the server must have started once on that
   machine first — the build stops with that instruction otherwise — and an
   APK built in this VM only works against a server in this VM.
-- Run the server for development with `--bind 127.0.0.1` (wg0 doesn't exist
-  on this machine yet; the default fails closed). First run prints the
-  enrollment QR/URI with the token — capture it from the log.
+- Run the server for development with `--bind 127.0.0.1`. Without it the
+  server binds wg0, which exists here but is unreachable from the emulator
+  (it dials 10.0.2.2). First run prints the enrollment QR/URI with the
+  token — capture it from the log.
 - Prefer exercising the server directly over going through the UI:
-  `curl --cacert certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  `curl --cacert ~/.config/ai-app/certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  The CA is wherever `--certs` put it — by default under
+  `$XDG_CONFIG_HOME` (`~/.config` when that is unset), never in the
+  checkout, so a relative `certs/ca.pem` finds nothing.
   The emulator app reaches it at `https://10.0.2.2:8443`; enroll it with
   `adb shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=8443&token=…'"`
   (quote so the device shell doesn't eat the `&`s).

server/src/auth.rs

@@ -9,8 +9,9 @@
 //! defense in depth rather than the sole gate.
 //!
 //! Nothing in this module -- and nothing anywhere else -- may log the
-//! Authorization header or the token; `token_is_never_logged` below holds a
-//! tripwire against a logging change silently starting to.
+//! Authorization header or the token; the test below holds a tripwire
+//! against a logging change silently starting to. It is one test covering
+//! both gating and logging on purpose -- see the note in it.
 
 use std::net::SocketAddr;
 use std::sync::Arc;

server/src/config.rs

@@ -7,7 +7,7 @@
 //! funnels through `SessionManager` (the registry pattern), so in-memory
 //! and on-disk state can't come apart.
 //!
-//! The file is RON, in the shape the [`format`] module describes -- the
+//! The file is RON, in the shape the [`mod@format`] module describes -- the
 //! same format, and the same two house rules, as the sibling dev-updater
 //! project's config, because both are written and read by hand.
 //!
@@ -30,9 +30,10 @@ use crate::private;
 ///
 /// **No outer parentheses.** A file *is* the body of the struct, so nothing
 /// in it is indented for the sake of a wrapper. RON has no implicit
-/// top-level struct (`de/mod.rs` requires the `(`), so [`parse`] adds it
-/// and [`render`] takes it back off. The opening paren is not followed by a
-/// newline, so a parse error's line number still points at the real line.
+/// top-level struct (`de/mod.rs` requires the `(`), so [`format::parse`]
+/// adds it and [`format::render`] takes it back off. The opening paren is
+/// not followed by a newline, so a parse error's line number still points
+/// at the real line.
 ///
 /// **`Some` is implicit.** Enabled on the deserializer rather than by a
 /// `#![enable(implicit_some)]` header the file would have to carry, and