docs(wear): rewrite run.sh help-text for profile-based builds

Drop DOCTATE_DEV_SERVER, DOCTATE_API_KEY, and DEFAULT_DEV_SERVER — the
profile file is the only source for URL + key now.

refs #3

clients/wearos/run.sh

@@ -2,23 +2,27 @@
 # Build / install / run helper for the Wear OS app.
 #
 # Usage:
-#   ./run.sh <target> <subcommand> [args]
+#   ./run.sh <target> [profile] <subcommand> [args]
 #
 # A target prefix is REQUIRED for every device-bound subcommand. The script
 # never silently picks "the first attached device" — if more than one candidate
 # exists it asks, and if ADB_SERIAL/WEAR_AVD pins a choice it uses that.
 #
 # Target prefix (or DOCTATE_TARGET env var):
-#   watch         Real Pixel Watch over ADB-WiFi. Uses the cached serial
+#   watch <profile>
-#                 from .watch_serial when it's attached; otherwise menu.
+#                 Real Pixel Watch over ADB-WiFi. <profile> is the basename of
-#                 Points the build at the dev laptop's LAN URL
+#                 a file in profiles.d/<profile>.sh that holds SERVER_URL,
-#                 ($DOCTATE_DEV_SERVER).
+#                 API_KEY, and ALLOWED_SERIALS (see profiles.d/*.sh.example).
-#   emulator      Wear OS AVD on this host.
+#                 The build refuses to proceed if the attached watch's ADB
+#                 serial is not listed in the profile's ALLOWED_SERIALS — this
+#                 protects against installing the wrong key on the wrong watch.
+#   emulator      Wear OS AVD on this host. No profile — uses the hardcoded
+#                 emulator-loopback URL (10.0.2.2:3000) and the build's
+#                 MISSING_API_KEY sentinel.
 #                 - 0 emulators running → menu of AVDs from `emulator -list-avds`
 #                 - ≥1 running          → menu of running serials + "Start a new AVD"
-#                 The script never auto-picks a running emulator. To bypass the
+#                 To bypass the menu pin the choice via ADB_SERIAL=<serial> or
-#                 menu, pin the choice via ADB_SERIAL=<serial> or WEAR_AVD=<name>.
+#                 WEAR_AVD=<name>.
-#                 Build keeps its emulator default (10.0.2.2:3000).
 #
 # Subcommands that need a target:
 #   (none)        install + start (default inner loop)
@@ -43,13 +47,10 @@
 # Env vars:
 #   DOCTATE_TARGET    Same as the <target> prefix (watch|emulator).
 #                     The CLI prefix takes precedence when both are set.
-#   ADB_SERIAL        Pin a specific device serial. Skips the menu entirely.
+#   DOCTATE_PROFILE   Same as the [profile] positional. The CLI value wins.
-#   DOCTATE_DEV_SERVER
+#   ADB_SERIAL        Pin a specific device serial. Skips the menu entirely
-#                     LAN URL of the Axum dev server, used by 'watch' target.
+#                     AND the profile allow-list (it is still verified — pinning
-#                     Default: http://192.168.178.27:3000
+#                     to a non-allowed serial dies with the same refusal).
-#   DOCTATE_API_KEY   If set, passed as -Pdoctate.apiKey=... to Gradle and
-#                     baked into BuildConfig.API_KEY at compile time.
-#                     Otherwise the value from local.properties is used.
 #   WEAR_AVD          AVD name to auto-boot when no emulator is attached
 #                     (skips the AVD menu; useful for CI / scripted runs).
 #   SKIP_INSTRUMENTED set to 1 to limit `test` to JVM unit tests (no device needed).
@@ -61,7 +62,6 @@ PACKAGE="com.doctate.watch"
 ACTIVITY=".presentation.MainActivity"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WATCH_SERIAL_FILE="$SCRIPT_DIR/.watch_serial"
-DEFAULT_DEV_SERVER="http://192.168.178.27:3000"
 
 # Populated by apply_target / parsed args. Empty = no override.
 ADB_SERIAL="${ADB_SERIAL:-}"