feat(wear): wire watch profile into apply_target + argument parser

./run.sh watch <profile> <subcmd> [args]

The second positional after \`watch\` is now the profile name. apply_target
calls load_profile + verify_serial_allowed before Gradle, so a wrong-watch
install refuses fast without burning a build. DOCTATE_API_KEY pass-through
is gone — keys come from the profile file only.

refs #3

clients/wearos/run.sh

@@ -66,6 +66,7 @@ DEFAULT_DEV_SERVER="http://192.168.178.27:3000"
 # Populated by apply_target / parsed args. Empty = no override.
 ADB_SERIAL="${ADB_SERIAL:-}"
 DOCTATE_TARGET="${DOCTATE_TARGET:-}"
+DOCTATE_PROFILE="${DOCTATE_PROFILE:-}"
 GRADLE_PROPS=()
 
 # --- Output helpers --------------------------------------------------------
@@ -325,13 +326,21 @@ This refusal protects against installing the wrong key on the wrong watch
 apply_target() {
     case "$DOCTATE_TARGET" in
         watch)
+            [[ -n "$DOCTATE_PROFILE" ]] || die \
+                "Watch target requires a profile. Usage: ./run.sh watch <profile> <subcmd>
+Available profiles: $(cd "$SCRIPT_DIR/profiles.d" 2>/dev/null && ls *.sh 2>/dev/null | sed 's/\.sh$//' | tr '\n' ' ')"
+            load_profile "$DOCTATE_PROFILE"
             if [[ -z "$ADB_SERIAL" ]]; then
                 resolve_watch_serial
                 ADB_SERIAL="$RESOLVED_SERIAL"
             fi
-            local server="${DOCTATE_DEV_SERVER:-$DEFAULT_DEV_SERVER}"
-            GRADLE_PROPS+=("-Pdoctate.serverUrl=$server")
-            info "Target: watch (serial=$ADB_SERIAL, server=$server)"
+            verify_serial_allowed "$ADB_SERIAL"
+            GRADLE_PROPS+=(
+                "-Pdoctate.serverUrl=$SERVER_URL"
+                "-Pdoctate.apiKey=$API_KEY"
+                "-Pdoctate.profileName=$DOCTATE_PROFILE"
+            )
+            info "Target: watch (profile=$DOCTATE_PROFILE, serial=$ADB_SERIAL, server=$SERVER_URL)"
             ;;
         emulator)
             if [[ -z "$ADB_SERIAL" ]]; then
@@ -348,9 +357,6 @@ apply_target() {
             ;;
     esac
 
-    if [[ -n "${DOCTATE_API_KEY:-}" ]]; then
-        GRADLE_PROPS+=("-Pdoctate.apiKey=$DOCTATE_API_KEY")
-    fi
     if [[ -n "$ADB_SERIAL" ]]; then
         GRADLE_PROPS+=("-Pandroid.injected.device.serial=$ADB_SERIAL")
         # AGP's `android.injected.device.serial` silently falls back to "all
@@ -575,6 +581,22 @@ cmd_help() {
 if [[ "${1:-}" == "watch" || "${1:-}" == "emulator" ]]; then
     DOCTATE_TARGET="$1"
     shift
+    # The watch target requires a profile name as the next positional. The
+    # emulator target does not — it always uses the hardcoded loopback URL.
+    if [[ "$DOCTATE_TARGET" == "watch" ]]; then
+        # Target-free subcommands that follow `watch` directly (none today,
+        # but kept defensively) should not be misread as a profile name.
+        case "${1:-}" in
+            ""|help|-h|--help|devices|connect|clean)
+                # No profile, fall through — apply_target will die with a
+                # clear usage message if the subcommand actually needs one.
+                ;;
+            *)
+                DOCTATE_PROFILE="$1"
+                shift
+                ;;
+        esac
+    fi
 fi
 
 # Subcommands that are device- and target-agnostic bypass apply_target so