wg-app-link: the WireGuard-and-pinned-TLS half both apps needed

The Rust crate and the Android half of one arrangement: a server that binds
the tunnel interface and nothing else, certificates it generates and keeps
outside any shared checkout, enrolment that carries a token and the CA to a
phone, and a client that trusts exactly that certificate and no other.

Extracted because ai-app and dev-updater had written all of it twice and the
two copies had already drifted -- one of them carried a bug the other did
not. History before this point was squashed away; it was a running record of
that extraction and of a personal machine's addresses, and neither is worth
keeping in a public repository.

server/src/lib.rs

@@ -0,0 +1,35 @@
+//! What dev-updater and ai-app both need in order to be reached from a
+//! phone, and nothing either of them does afterwards.
+//!
+//! Both projects are the same shape underneath: a server on a machine
+//! somebody owns, bound to a WireGuard interface so it is not on the LAN,
+//! presenting a certificate from a CA the app pins, and answering only
+//! requests carrying a bearer token that was enrolled by scanning a QR
+//! code off the terminal. None of that is about serving APKs or running
+//! model sessions -- it is the link, and it was written twice.
+//!
+//! # What belongs here
+//!
+//! Anything that would be *identical* in a third such project. The test
+//! applied to each module below was to diff the two existing copies: if
+//! the only differences were a product name and which state type the code
+//! was generic over, it came here.
+//!
+//! # What deliberately does not
+//!
+//! The API surfaces. dev-updater's routes are about projects and builds,
+//! ai-app's about sessions and providers, and their HTTP clients have
+//! diverged to 14% similarity because they are genuinely different
+//! programs. Sharing a transport is worth doing; sharing an API would mean
+//! inventing a common vocabulary neither project wants.
+//!
+//! Config *schemas*, for the same reason -- though the RON house rules
+//! that both files are written in are shared, since those were identical
+//! to the byte.
+
+pub mod certs;
+pub mod enroll;
+pub mod format;
+pub mod netif;
+pub mod private;
+pub mod xdg;