wg-app-link: follow the enrollment link's new optional CA parameter

The shared enrollment_uri/print_enrollment now take the CA the link should
carry, for ai-app's iris client -- an APK cross-compiled somewhere other
than the machine its server runs on, which therefore cannot pin at build
time. This app is built on the machine it talks to, so it passes None and
its QR is unchanged; the reason is written at the call site.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server/src/auth.rs

@@ -47,8 +47,14 @@ pub use wg_app_link::enroll::{generate_token, token_hash_hex};
 /// where to connect and the bearer token. The CA stays embedded in the APK,
 /// so this carries no trust material -- photographing the terminal leaks
 /// only the token, which is rotatable (`--rotate-token`).
+///
+/// `None` for the shared function's optional CA, deliberately: this app is
+/// built on the machine it talks to and pins that build's certificate, so
+/// carrying the CA here would only cost the QR the extra 48 columns
+/// `enroll::ca_param` documents. ai-app passes one because its iris client
+/// is cross-compiled elsewhere.
 pub fn print_enrollment(host: IpAddr, port: u16, token: &str) -> anyhow::Result<()> {
-    wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token)
+    wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token, None)
 }
 
 pub async fn require_token(