dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

build-self.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Rebuilds this server and its app, in the order a self-update needs.
+#
+# For running by hand. The "Dev Updater" card no longer calls this: the two
+# halves are declared as a Server and an Apk component in
+# app/.dev-updater.ron, and a build walks components in order, so the order
+# below is expressed there now.
+#
+# Still has two callers, so it stays: ./start.sh builds through it, and a
+# server started before the components change has the old declaration in
+# memory pointing straight here -- the pull that carries that change is
+# built from it.
+#
+# The APK is built last and deliberately after the binary: if the build
+# fails, the phone keeps being offered the APK it already had rather than
+# a half-updated pair.
+set -eu
+cd "$(dirname "$0")"
+
+echo "==> Building the server"
+cargo build --release --manifest-path server/Cargo.toml
+
+echo "==> Building the app"
+./app/build-apk.sh