dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

resources.ron

@@ -0,0 +1,18 @@
+// This project's own resources: the values it would otherwise have to
+// write down in several places.
+//
+// Structured as the body of the struct, with no outer parentheses, which
+// is the house rule every RON file here follows -- `wg_app_link::format`
+// is the only thing that knows it, so both this project's code and Dev
+// Updater read the file the same way.
+//
+// Dev Updater reads the keys it understands (see `Resources` in
+// `server/src/config.rs`) and ignores the rest, so anything else this
+// project needs to keep in one place belongs here too.
+
+// What this project calls itself for the purpose of keeping state, which
+// is where `~/.local/share/dev-updater` and `~/.config/dev-updater` come
+// from. Not the crate name, which answers to a registry's namespace
+// rather than to this; and not the label, which is what a person reads on
+// a card.
+name: "dev-updater",