server: relay a test device's adb endpoint, because mDNS does not cross subnets

The beacon this replaces was a separate service wildcard-bound to
0.0.0.0:443 - it silently occupied port 443 on the reserved measurement
addresses, voiding the IPv4 interception proof for as long as it ran, and
it accepted a port report from anyone who could reach it. So this lives
where the repo's own post-mortem said it belongs: POST on the control
plane authenticated by the device credential, GET on the admin UI behind
the existing apiAdmin helper. No new listener, no new port, no wildcard.

Entries expire after 24h (ECHOLOT_ADB_ENDPOINT_RETENTION_H) on both write
and read - a LAN address is a breadcrumb for driving a test device, not
measurement data worth keeping.

Also records the BLE peer-comparison design: the case for it is that BLE
is out-of-band, which is what makes client isolation measurable at all -
silence over IP cannot distinguish an isolating AP from an absent peer,
and a peer confirming out-of-band that it was listening turns that
silence into proof.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/store/store.go

@@ -56,6 +56,9 @@ type Store struct {
 	mu   sync.Mutex
 	path string
 	data fileData
+	// How long relayed adb endpoints live. Configuration rather than state, so it is set by the
+	// caller after Open and never read back from the file (see SetADBEndpointRetention).
+	adbRetention time.Duration
 }
 
 type fileData struct {
@@ -67,6 +70,9 @@ type fileData struct {
 	// deleting it from the state file invalidates every session at once, which is how an
 	// operator revokes them.
 	SessionSecret string `json:"session_secret,omitempty"`
+	// Dev-relay breadcrumbs (adbendpoint.go). Not measurement data and not part of the protocol;
+	// they ride along here because this is already where small server state lives.
+	ADBEndpoints []ADBEndpoint `json:"adb_endpoints,omitempty"`
 }
 
 func Open(stateDir string) (*Store, error) {