wg-app-link: the WireGuard-and-pinned-TLS half both apps needed

The Rust crate and the Android half of one arrangement: a server that binds
the tunnel interface and nothing else, certificates it generates and keeps
outside any shared checkout, enrolment that carries a token and the CA to a
phone, and a client that trusts exactly that certificate and no other.

Extracted because ai-app and dev-updater had written all of it twice and the
two copies had already drifted -- one of them carried a bug the other did
not. History before this point was squashed away; it was a running record of
that extraction and of a personal machine's addresses, and neither is worth
keeping in a public repository.

run-tests.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+# Runs this crate's tests. Extra arguments are forwarded to `cargo test`.
+set -eu
+cd "$(dirname "$0")/server"
+exec cargo test "$@"