wg-app-link: the WireGuard-and-pinned-TLS half both apps needed

The Rust crate and the Android half of one arrangement: a server that binds
the tunnel interface and nothing else, certificates it generates and keeps
outside any shared checkout, enrolment that carries a token and the CA to a
phone, and a client that trusts exactly that certificate and no other.

Extracted because ai-app and dev-updater had written all of it twice and the
two copies had already drifted -- one of them carried a bug the other did
not. History before this point was squashed away; it was a running record of
that extraction and of a personal machine's addresses, and neither is worth
keeping in a public repository.

app/build.gradle.kts

@@ -0,0 +1,52 @@
+// The app half of the link, as a library both phones' apps depend on.
+//
+// Consumed as a *subproject* of each app's build rather than as a published
+// artifact or a composite build, so the two stay version-locked to whatever
+// commit of this repo the consuming project's submodule points at -- the
+// same arrangement the Rust half uses with a path dependency. Each app adds
+// two lines to its `settings.gradle.kts`:
+//
+//     include(":link")
+//     project(":link").projectDir = file("../wg-app-link/app")
+//
+// and one entry to its version catalog, since a subproject resolves plugin
+// versions from the build including it:
+//
+//     androidLibrary = { id = "com.android.library", version.ref = "agp" }
+//
+// Deliberately no Compose. Nothing here draws anything -- the screens that
+// use it are each app's own, because they are where the two products
+// actually differ.
+plugins {
+    alias(libs.plugins.androidLibrary)
+    alias(libs.plugins.ktfmt)
+}
+
+ktfmt { kotlinLangStyle() }
+
+android {
+    namespace = "com.example.wgapplink"
+    compileSdk = 37
+
+    // minSdk matches the lower of the two consumers rather than this
+    // library's own preference: a library that raised it would silently
+    // raise theirs. No desugaring here for the same reason -- nothing in
+    // this module uses java.time, and requiring it would impose a build
+    // setting on anyone who depends on it.
+    defaultConfig { minSdk = 24 }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_21
+        targetCompatibility = JavaVersion.VERSION_21
+    }
+}
+
+dependencies {
+    // SharedPreferences.edit, and the KTX extensions this code calls
+    // directly rather than inheriting transitively.
+    implementation(libs.androidx.core.ktx)
+    // The capture activity EnrollmentScanActivity subclasses. `api` rather
+    // than `implementation`: the subclass is part of this module's public
+    // surface, so a consumer declaring it in its manifest needs the type.
+    api(libs.zxing.embedded)
+}