feat(app): enable the supported relay by default - #921

What changes

• Treat an omitted app_link section as enabled, so upgraded boxes use the supported FTW app relay without a YAML edit.
• Preserve app_link.enabled: false, YAML app_link: / null / {}, and JSON "app_link": null as opt-outs.
• Keep the Settings fallback in step with Core and make the example config show the default.
• State the privacy boundary plainly: relay frames are end-to-end encrypted, but the relay still sees source IP, timing, and connection continuity.
• Update the app-uplink ADR to match the shipped pairing, device-removal, and owner rules.

The relay endpoint and protocol remain fixed. This change does not alter pairing keys, command checks, or hardware control.

Compatibility proof

The round-trip tests start with an old YAML file that has no app_link, load it, fetch it through GET /api/config, save that response through POST /api/config, read the file again, and prove the app link stays on after restart. Separate tests keep explicit false, YAML null and an empty section off. The API test proves JSON null is stored as an explicit opt-out and stays off after restart.

Verification

Head: e295fe48e8d44b49c326c256e8a2e40c0f09cf04

• git range-diff: the first two feat(app): enable the supported relay by default #921 commits remain patch-identical after restacking on master 1acb8097ec51b12fa744ff65f525df4c280435c5.
• Aggregate patch ID stayed 0407921a54957a6d82a38130181847ad4a71d9f9.
• The old-client regression failed on parent 8af080f7: an omitted app_link produced a false app-link restart reason. It passes after the third commit, while explicit JSON null and false still turn the link off and require restart.
• Exact head: focused cmd/ftw app-link API race tests passed 20 times.
• Exact head: focused internal/config restart/app-link race tests passed 20 times.
• Direct parent 8af080f7 passed all 340 web tests and make verify, including 167 optimizer tests, Go tests, compose migration, module boundaries, exact-image promotion, vet, and build. Exact-head GitHub checks must also pass before merge.

Human browser gate before merge

Serve this exact head from a box. Check both desktop at 1440 x 900 and a narrow mobile viewport at 390 x 844.

• With an old config that omits app_link, Settings -> FTW app opens with the checkbox checked. Save and restart; it stays checked and the running status becomes available.
• With app_link.enabled: false, and once with an empty or null YAML section, the checkbox opens unchecked. Save and restart; it stays off and no pairing action is enabled.
• Toggle from on to off and from off to on. Before restart, the status text must say what is running now and what will change after restart. After restart, it must match the saved switch.
• Read the privacy text in both widths. It must say that readings and commands are end-to-end encrypted, that Sourceful can see the IP and when the box is connected, and that Sourceful cannot read the frames. No line may clip or cause horizontal scroll.
• When connected, Show pairing code becomes enabled. The owner explanation, QR, expiry line, and spoken-code fallback fit without clipping; the QR stays square and scans from the phone.
• After one phone is paired, the phone row, role, last-seen text, Remove, and Let someone see this home fit and remain usable. The viewer QR and its access explanation also fit and scan.
• On narrow mobile, the action buttons, device rows, warning dialog, QR, and spoken code remain inside the viewport and can be reached without content hiding behind the fixed navigation.

Do not merge until a human checks every box above.

Release order

#928 and #932 are already on master. Merge this PR only after the browser gate passes. Then let the release workflow refresh Version Packages PR #824 from the resulting master; do not merge the current #824 head first.