[Experimental] Wireless ADB: USB enable step + WebSocket bridge

[andronedev]

⚠️ Experimental. This is a first working cut of wireless ADB. The core is
verified on real hardware, but it needs a production certificate and code
signing before it ships to users. Do not merge to a release without the
follow-ups below.

What this adds

Manage a Portal over Wi-Fi, not only over the USB cable, while keeping the
browser-first, no-backend identity. Full spec in docs/prd-wireless-adb.md.

A browser tab cannot open a raw TCP socket, so this ships in two honest halves:

1. A USB-side "Enable wireless" step that needs nothing installed.
2. An optional local bridge (a Rust companion) that relays the browser's
   WebSocket to the device's ADB TCP port. It is a dumb byte pipe: ADB's RSA
   handshake runs end to end in the browser, so the bridge holds no keys.

Browser (this repo)

• Transport seam in src/lib/adb/connection.ts (ActiveConnection, usb/wireless
  kinds) feeding the same AdbDaemonTransport.authenticate.
• Device-side enable via adb.tcpip.setPort(5555) reusing the existing
  getIpAddress (src/lib/adb/wireless.ts); endpoint persisted in
  wireless-store.
• WebSocket transport that frames the raw ADB packet stream and probes the
  bridge /health (src/lib/adb/ws-connection.ts).
• connectViaWireless in device-store; WirelessPanel.tsx UI (enable on the
  dashboard, reconnect on the connect screen). i18n en + fr.

Bridge (new Rust crate at bridge/, polyglot monorepo)

• axum relay on 127.0.0.1: GET /health (JSON + CORS) and
  GET /adb?ip=&port=5555 upgraded to a byte pipe to the device.
• Security: loopback-only, Origin allowlist, RFC1918 + port 5555 target
  restriction, optional pinned device IP, no ADB keys held.
• Cargo features: default networking core; tls (axum-server) and desktop
  (tray-icon/tao + auto-launch) gated.

Monorepo wiring

• deploy.yml ignores bridge/**; new bridge.yml (clippy/test on PRs,
  release matrix on bridge-v* tags); biome ignores bridge; gitignore adds
  bridge/target.
• Docs: corrected the --wifi-adb note in docs/programs.md; PRD updated with
  status, pinned bridge contract, and stack.

Verified

• pnpm lint + pnpm build green; cargo check/clippy -D warnings green
  (core and production).
• Bridge runtime smoke test: health/CORS/origin/port/SSRF guards behave.
• On a real Portal+ (aloha, Android 9): adb tcpip 5555 + wireless connect
  work; the bridge relayed a real ADB CNXN and the device answered AUTH
  through the WebSocket; scrcpy 2.3 server runs and exposes an H.264 encoder, so
  screen mirroring works over Wi-Fi (no audio, as before).
• End-to-end in the browser UI: enable over USB, then reconnect over Wi-Fi via
  the bridge, then screen mirror.

Not ready yet (follow-ups)

• Production Let's Encrypt certificate for local.openportal.cc (prod uses WSS;
  dev uses plain ws to loopback, already working).
• macOS notarization and Windows Authenticode signing for the bridge installers.
• Doc nit: scrcpy.ts / CLAUDE.md say "Android 10" but Gen 1 is Android 9
  (conclusion of "no audio" still holds; audio needs Android 11+).

How to test

pnpm dev, then adb kill-server, connect over USB, click Enable wireless
ADB, run cargo run --manifest-path bridge/Cargo.toml, then Reconnect over
Wi-Fi and open the screen mirror.