wg-app-link: the WireGuard-and-pinned-TLS half both apps needed

The Rust crate and the Android half of one arrangement: a server that binds
the tunnel interface and nothing else, certificates it generates and keeps
outside any shared checkout, enrolment that carries a token and the CA to a
phone, and a client that trusts exactly that certificate and no other.

Extracted because ai-app and dev-updater had written all of it twice and the
two copies had already drifted -- one of them carried a bug the other did
not. History before this point was squashed away; it was a running record of
that extraction and of a personal machine's addresses, and neither is worth
keeping in a public repository.

server/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "wg-app-link"
+version = "0.1.0"
+edition = "2024"
+description = "The private link between a phone and a machine you run: WireGuard binding, a self-signed CA the app pins, and QR enrollment of a bearer token."
+
+[dependencies]
+anyhow = "1"
+# The config format both projects use, and the two house rules they share.
+ron = "0.12.2"
+serde = { version = "1", features = ["derive"] }
+# Enumerating this machine's addresses, and finding the tunnel's.
+if-addrs = "0.15"
+# Token auth: hash for storage, constant-time compare for verification,
+# CSPRNG-backed generation, base64url for the enrollment string.
+sha2 = "0.11"
+subtle = "2"
+rand = "0.10"
+base64 = "0.23"
+# Renders the enrollment QR straight to the terminal; no image output.
+qrcode = { version = "0.14", default-features = false }
+tracing = "0.1"
+# Generates the CA and leaf in process, so one place decides the
+# extensions, the file modes, and which addresses the leaf covers.
+# x509-parser so the issuer is read back from the CA actually on disk
+# rather than reconstructed from parameters that may since have changed.
+rcgen = { version = "0.14", features = ["pem", "x509-parser"] }
+
+[dev-dependencies]
+tempfile = "3"