refactor!: move client adoption, MCP editing and the client scan to the desktop app

[fylorn]

Phase P3 of the remote-core plan, core side. Adopting AI clients, editing their MCP servers and scanning their configuration all change files on the machine the desktop app runs on. With remote core that may not be the machine running core, so this work moves to the app: ThinkWatch-Lite takes over the tw-adopt and tw-scan crates and the file watcher in ThinkWatchProject/ThinkWatch-Lite#180. Merge that PR first. It stops calling these endpoints and still works against v0.46.0.

Removed

• The tw-adopt and tw-scan crates
• tw-control: scan.rs (scan endpoint and client-config watcher); clients.rs except POST /clients/{id}/key; ControlState.home and home_dir()
• tw_api::ep: Scan, Clients, PlanAdopt, Adopt, PlanRestore, Restore, Why, McpTargets, McpPlan, McpApply, plus every type only they used (ScanRequest/Response, ScanFinding, McpView, SkillView, HookView, McpOp*, McpTargetView, ClientsResponse, DetectedClient, ManualClient, ManualSetup, AdoptRequest/Response, PlanView, FieldChange, FieldOp, FindingView, FindingLevel, TakesEffect, Verification, KeySynced, KeySyncFailed)
• The Event::ClientsChanged and Event::ScanAlert events
• The twcore scan and twcore clients subcommands
• Key rotation no longer writes the new key into an adopted client (KeyRotated is just { version, key }), and key deletion no longer checks for an adopted client. The app does both, because only it can see the client's files.
• tw-control/tests/m4_acceptance.rs: its checks (adopt, restore byte for byte, zero-width detection, never deleting) moved with the crates.

Kept

• POST /clients/{id}/key. It returns the key already bound to that client or creates one bound to it (claude-code, then claude-code-2 if that name is taken). Core no longer holds the client list, so it accepts any id that looks like a client id (lowercase letters, digits, -, at most 64 characters). The app decides which clients exist. With no gateway key at all it still answers control.no_keys.

Contract

• Rebased onto feat(control): one control key and a Noise handshake on every control connection #184 (Noise handshake, which took 18): CONTROL_API_VERSION 18 → 19, with a doc entry. The handshake test in tests/gate.rs now checks against CONTROL_API_VERSION instead of a hardcoded 18.
• msg-codes.txt drops adopt.*, scan.*, control.key_bind_failed and control.key_used_by_client. Lite now keeps its own src-tauri/msg-codes.txt for the codes it emits, including control.key_used_by_client. When lite bumps to this core, it must delete the control.key_bind_failed translation, drop the two scan_alert/clients_changed cases in src/types.ts, and remove the transitional sync handling in rotate_key. I checked this by building lite against this branch with a [patch]: only those spots break.

Docs and tests

• README / README.zh-CN crate layers and CONTRIBUTING now say where adoption lives.
• scripts/smoke.sh checks the client-key endpoint (issued once, then the same key again) instead of the adopt round trip.
• New tw-guard/tests/reads_only.rs: the two files the client scan uses (hidden.rs, tools/rules.rs) cannot write or delete anything. The scan's own copy of this check moved with it.
• The remaining replay/diagnostics tests from tests/adopt.rs are now in tests/bundle.rs. The client-key tests are in tests/client_key.rs.

Local run: cargo fmt --check, cargo clippy --workspace --all-targets -D warnings and cargo test --workspace all pass; scripts/smoke.sh passes 56, fails 0 (after the rebase).

Crate and binary versions are unchanged and will be set at merge time.

🤖 Generated with Claude Code