Take the app half too, which was duplicated the same way

Four Kotlin files appeared in both apps. Diffed with the product names
normalised, EnrollmentScanActivity was 31 lines each differing in six --
all of them comments -- and PinnedCert was 58 against 59 with identical
TrustManager logic. That is the same evidence that moved the Rust half.

Two parameters, both per-app, and they fail differently. A wrong URI
scheme means a scanned QR is ignored, which is visible at once. A wrong
Keystore alias means the app cannot unseal the token it already stored,
so an enrolled phone reads as not enrolled and nothing says why -- so
both existing values are recorded in the README rather than left to be
rediscovered.

The certificate alias went the other way and became a constant: it names
an entry in a KeyStore that exists only in memory for the length of one
lazy block, so nothing ever reads it back and having two of them said
nothing.

The drift was in both directions, as the evidence predicted: ai-app had
gained localNetworkAllowed -- which matters because Android 17's
ACCESS_LOCAL_NETWORK denial is invisible at the socket, and without it a
blocked app and an unreachable server produce the same timeout -- and had
moved to the KTX `edit` block. dev-updater had neither, and gets both.

No Compose, deliberately. Nothing here draws anything; the screens are
each app's own because that is where the two products actually differ.

The PinnedCaCertificate generator did not move, and the README says why:
all three things it varies are per-app, so sharing it means a composite
build neither project has. Its one historical bug is already fixed
identically in both copies.

app/build.gradle.kts

@@ -0,0 +1,52 @@
+// The app half of the link, as a library both phones' apps depend on.
+//
+// Consumed as a *subproject* of each app's build rather than as a published
+// artifact or a composite build, so the two stay version-locked to whatever
+// commit of this repo the consuming project's submodule points at -- the
+// same arrangement the Rust half uses with a path dependency. Each app adds
+// two lines to its `settings.gradle.kts`:
+//
+//     include(":link")
+//     project(":link").projectDir = file("../wg-app-link/app")
+//
+// and one entry to its version catalog, since a subproject resolves plugin
+// versions from the build including it:
+//
+//     androidLibrary = { id = "com.android.library", version.ref = "agp" }
+//
+// Deliberately no Compose. Nothing here draws anything -- the screens that
+// use it are each app's own, because they are where the two products
+// actually differ.
+plugins {
+    alias(libs.plugins.androidLibrary)
+    alias(libs.plugins.ktfmt)
+}
+
+ktfmt { kotlinLangStyle() }
+
+android {
+    namespace = "com.example.wgapplink"
+    compileSdk = 37
+
+    // minSdk matches the lower of the two consumers rather than this
+    // library's own preference: a library that raised it would silently
+    // raise theirs. No desugaring here for the same reason -- nothing in
+    // this module uses java.time, and requiring it would impose a build
+    // setting on anyone who depends on it.
+    defaultConfig { minSdk = 24 }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_21
+        targetCompatibility = JavaVersion.VERSION_21
+    }
+}
+
+dependencies {
+    // SharedPreferences.edit, and the KTX extensions this code calls
+    // directly rather than inheriting transitively.
+    implementation(libs.androidx.core.ktx)
+    // The capture activity EnrollmentScanActivity subclasses. `api` rather
+    // than `implementation`: the subclass is part of this module's public
+    // surface, so a consumer declaring it in its manifest needs the type.
+    api(libs.zxing.embedded)
+}