dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

test-projects/service-and-app/serve.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# The long-running half of this test project: a service that does nothing
+# except say so, once every ten seconds, forever.
+#
+# It writes into its own data directory -- the one resources.ron names -- so
+# that Uninstall's "remove data" toggle has something real to remove, and so
+# that the directory exists to be shown in the dialog. Its *log* is not
+# written here: a managed service's output is captured by Dev Updater's
+# service script, which is what the runtime log tab reads.
+set -eu
+
+DATA="${XDG_DATA_HOME:-$HOME/.local/share}/dutest-service"
+mkdir -p "$DATA"
+
+echo "started at $(date -Is), writing to $DATA"
+count=0
+while true; do
+    count=$((count + 1))
+    echo "$(date -Is) tick $count" >>"$DATA/ticks.log"
+    # Colour, so the runtime log tab has escapes to render too -- the same
+    # reason breakable/build.sh writes them.
+    printf 'tick \033[1;32m%s\033[0m -- still here\n' "$count"
+    sleep 10
+done