protocol: enrollment links carry the public name, not the endpoint

Sharing port 443 between the admin UI and the control plane forces two
hostnames — one port and one name is one certificate, and the two need
different ones. That difference had been leaking into every enrollment
link, so an operator handed out fmr-1.echo-lot.app when the thing they
and their users know is fmr.echo-lot.app.

The link now carries the public name and the app asks GET /v1/discover
where to actually connect. The endpoint is plumbing: it exists to select
a certificate, and nobody needs to see it.

Discovery hands out an address and never a pin. The pin stays in the
link. Fetching it over an ordinary TLS connection would make pinning
worth exactly what the certificate authorities are worth, and pinning is
there to survive one the operator does not control — a root injected by
corporate device management, say, which is unremarkable on the networks
this tool gets pointed at. With the pin pre-shared, an intercepted
discovery can only send a device somewhere the pin will not match: an
outage, not a compromise.

Optional on both sides. A server that does not answer, or a link that
already names the control endpoint, works unchanged — enrollment must not
start failing because a lookup did.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunStore.kt

@@ -125,6 +125,7 @@ class RunStore(context: Context, private val settings: Settings) {
             val enrolled = parsed.redeem(deviceName, BuildConfig.APP_SEMVER)
             val compat = Compat.check(enrolled.profile, BuildConfig.APP_SEMVER)
             settings.serverUrl = enrolled.controlUrl
+            settings.serverPublicUrl = enrolled.publicUrl
             settings.serverPin = enrolled.pin
             settings.serverCredential = enrolled.credential
             val head = "Enrolled with ${enrolled.profile.name} " +

echolot-app/app/src/main/kotlin/app/echo_lot/app/Settings.kt

@@ -97,6 +97,17 @@ class Settings(context: Context) {
         get() = prefs.getString(SERVER_PIN, "") ?: ""
         set(v) = prefs.edit().putString(SERVER_PIN, v.trim()).apply()
 
+    /**
+     * The address the operator handed out, for showing to a person.
+     *
+     * Separate from [serverUrl], which is the endpoint actually dialled. They differ when the
+     * server publishes one public name and points devices at another to select its pinned
+     * certificate — a detail worth keeping out of the user's face but not out of the settings.
+     */
+    var serverPublicUrl: String
+        get() = (prefs.getString(SERVER_PUBLIC_URL, "") ?: "").ifBlank { serverUrl }
+        set(v) = prefs.edit().putString(SERVER_PUBLIC_URL, v.trim()).apply()
+
     var serverCredential: String
         get() = prefs.getString(SERVER_CRED, "") ?: ""
         set(v) = prefs.edit().putString(SERVER_CRED, v.trim()).apply()
@@ -172,6 +183,7 @@ class Settings(context: Context) {
         const val SERVER_URL = "server_url"
         const val SERVER_PIN = "server_pin"
         const val SERVER_CRED = "server_credential"
+        const val SERVER_PUBLIC_URL = "server_public_url"
         const val CANARY_ZONE = "server_canary_zone"
         const val PENDING_VERIFIER = "pending_auth_verifier"
         const val PENDING_STATE = "pending_auth_state"