dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

test-projects/service-and-app/.dev-updater.ron

@@ -0,0 +1,38 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// The two-component case: a server on the build machine beside an APK for
+// the phone. That pairing is what Dev Updater itself is, so it is the shape
+// most worth having a second of -- a project where breaking something
+// cannot take the updater down with it.
+//
+// What it exercises that a one-component project cannot: two builds running
+// at once with a bar and a timing each, the project area at the bottom
+// holding only what belongs to the whole project, and the whole service
+// contract -- install, start, stop, status, restart, and a runtime log that
+// is not this server's own.
+label: "Test: Service + App",
+
+// Declared, so the Uninstall dialog has real paths to show and its data and
+// config toggles are enabled. `hello-app` deliberately declares nothing,
+// which is the other half of that test.
+resources: Ron("resources.ron"),
+
+components: [
+    Server(
+        name: "daemon",
+        build: "./build-daemon.sh",
+        // Managed, so Dev Updater's own service script drives it and this
+        // project needs no systemd or OpenRC knowledge of its own. The
+        // unit is named `<key>-daemon` after the key this project is added
+        // under.
+        //
+        // The leading `./` is load-bearing: service-default.sh resolves a
+        // program containing a slash against the working directory and
+        // looks anything else up on PATH.
+        service: Managed("./serve.sh"),
+    ),
+    Apk(
+        name: "app",
+        build: ["../lib/build-apk.sh", "--package", "com.example.dutest.service", "--label", "Test Service"],
+    ),
+],