Say what the code actually does, in the three places that had drifted

A doc comment is not compiled, so nothing catches one that has outlived
what it described. `cargo doc` does catch a subset, and it was failing:
three unresolved intra-doc links in config.rs, all mine from today -- two
naming `parse`/`render` from outside the module that defines them, and one
`format` that is ambiguous with the macro. Rustdoc now runs clean with
broken_intra_doc_links denied.

auth.rs's module doc pointed at a test called `token_is_never_logged`,
which no longer exists: it was folded into the combined gating+logging test
because tracing caches callsite interest process-wide. The doc now
describes the test that is there and says why it is one test.

AGENTS.md contradicted itself twice, both checked against a running server
rather than by reading. Its curl example passed `--cacert certs/ca.pem`, a
path relative to the checkout, while the bullet above it correctly says the
CA is generated under $XDG_CONFIG_HOME -- so the documented command fails
before it connects; with the real path it returns `[]`. And it said wg0
"doesn't exist on this machine yet" as the reason for --bind 127.0.0.1,
which the section below it already contradicts: wg0 is up at 10.66.0.1, and
the actual reason is that the emulator dials 10.0.2.2 and cannot reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

AGENTS.md

@@ -75,11 +75,15 @@ real-phone/WireGuard bring-up, which is operational rather than code.
   generated into a constant. So the server must have started once on that
   machine first — the build stops with that instruction otherwise — and an
   APK built in this VM only works against a server in this VM.
-- Run the server for development with `--bind 127.0.0.1` (wg0 doesn't exist
-  on this machine yet; the default fails closed). First run prints the
-  enrollment QR/URI with the token — capture it from the log.
+- Run the server for development with `--bind 127.0.0.1`. Without it the
+  server binds wg0, which exists here but is unreachable from the emulator
+  (it dials 10.0.2.2). First run prints the enrollment QR/URI with the
+  token — capture it from the log.
 - Prefer exercising the server directly over going through the UI:
-  `curl --cacert certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  `curl --cacert ~/.config/ai-app/certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  The CA is wherever `--certs` put it — by default under
+  `$XDG_CONFIG_HOME` (`~/.config` when that is unset), never in the
+  checkout, so a relative `certs/ca.pem` finds nothing.
   The emulator app reaches it at `https://10.0.2.2:8443`; enroll it with
   `adb shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=8443&token=…'"`
   (quote so the device shell doesn't eat the `&`s).