Attach url-shortener as git submodule (androidcast_project).

Standalone repo: git://f0xx.org/androidcast_project/url-shortener on branch main.
Removes vendored tree; adds backend/README.md and agent bootstrap note.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitmodules

@@ -11,3 +11,7 @@
 [submodule "third-party/wireguard-android"]
 	path = third-party/wireguard-android
 	url = https://git.zx2c4.com/wireguard-android
+[submodule "backend/url-shortener"]
+	path = backend/url-shortener
+	url = git://f0xx.org/androidcast_project/url-shortener
+	branch = main

AGENTS.md

@@ -18,5 +18,6 @@ After a **reset** or new session on deploy/infra work:
 2. For hub deploy only: **[examples/app_hub/DEPLOY.md](examples/app_hub/DEPLOY.md)**.
 3. For PHP/DB/tickets: **[examples/crash_reporter/backend/README.md](examples/crash_reporter/backend/README.md)**.
 4. For git branches: **[docs/GIT_FLOW.md](docs/GIT_FLOW.md)** — work on `feature/*` from `next`; do not commit unless asked.
+5. **URL shortener** is a **git submodule** at `backend/url-shortener` → `git://f0xx.org/androidcast_project/url-shortener`. **Never** edit shorten API PHP in the monorepo tree without committing inside the submodule first. Flow: `cd backend/url-shortener` → commit & push `main` → parent repo `git add backend/url-shortener` → bump submodule SHA. See [backend/README.md](backend/README.md).
 
 **Hard rule:** Port **8089** is **not** the androidcast vhost (Janus/other). Public apps path is **`https://apps.f0xx.org`** → BE **`http://artc0.intra.raptor.org:80`**.

backend/README.md

@@ -0,0 +1,32 @@
+# Backend services (submodules)
+
+| Path | Remote | Role |
+|------|--------|------|
+| [url-shortener/](url-shortener/) | `git://f0xx.org/androidcast_project/url-shortener` | Standalone short-link API (`https://s.f0xx.org`) |
+
+## Clone / update
+
+```bash
+git submodule update --init backend/url-shortener
+```
+
+## Development flow
+
+1. **URL shortener changes** — work inside the submodule only:
+   ```bash
+   cd backend/url-shortener
+   git checkout main && git pull
+   # edit, test, commit, push to url-shortener remote
+   git push origin main
+   ```
+2. **Pin new submodule SHA in android_cast** — after the submodule push:
+   ```bash
+   cd ../..   # repo root
+   git add backend/url-shortener
+   git commit -m "Bump url-shortener submodule"
+   git push origin <your-branch>
+   ```
+
+Hub admin UI for bearer tokens lives in `examples/crash_reporter/backend/` (crashes console) — not in this submodule.
+
+Spec (monorepo): [docs/specs/20100611_3_url_shortener.md](../docs/specs/20100611_3_url_shortener.md)

docs/DRs/20100611_3_url_shortener.md

@@ -79,7 +79,7 @@ Questions from draft §“TBD and open questions list” and inline `TBD` marker
 | Q4 | Java hash vs SHA-256 | **SHA-256** (see [§4](#4-slug-algorithm)). Java hash is 32-bit, non-cryptographic, JVM-stable but poor for URL slugs. |
 | Q5 | Interleaved URL+TOKEN string | **Rejected** for production. Deterministic `SHA256(bearer_id ‖ normalized_url)` instead. Draft interleave kept as historical note only. |
 | Q6 | Authentication: “app-wide shared session, project-wise token” | **Split roles:** `curl`/services → **project bearer token**; console operators → **shared `ac_crash_sess`** to create/revoke tokens (same RBAC as crashes/tickets). Shorten API does **not** accept PHP session cookies. |
-| Q7 | Submodule remote “available soon” | **Done** — `git://f0xx.org/androicast_project/url-shortener`; monorepo scaffold at `backend/url-shortener/`. |
+| Q7 | Submodule remote | **Done** — `git://f0xx.org/androidcast_project/url-shortener`; pinned at `backend/url-shortener/` submodule (`main`). |
 | Q8 | OTA-style “invalid URL” on unrelated services | N/A here; shorten service validates URL scheme/host and returns `INVALID_URL`. |
 | Q9 | Step 9.1.1 / 9.1.2 trusted sub-capabilities | `can_temporary` on bearer; `can_permanent` on bearer **and** valid signer required for `ttl=0`. |
 | Q10 | Cached hit when TTL “exceeds given limits” | If stored link **expired** → error `TTL_EXPIRED`, not silent renew. If valid → return same slug with **remaining** `ttl` in response (draft step 8). |
@@ -192,7 +192,7 @@ Internet → FE (s.f0xx.org TLS) → proxy_pass BE :80 → url-shortener php-fpm
 | FE TLS cert | PO / infra | **Done** — `/etc/letsencrypt/live/s.f0xx.org/` |
 | FE nginx `server_name s.f0xx.org` | DEV | [nginx.fe-s.f0xx.org.snippet](../../backend/url-shortener/deploy/nginx.fe-s.f0xx.org.snippet) |
 | BE vhost fragment | DEV | [nginx.be-url-shortener.fragment](../../backend/url-shortener/deploy/nginx.be-url-shortener.fragment) |
-| Git remote | PO | **Done** — `git://f0xx.org/androicast_project/url-shortener` |
+| Git remote | PO | **Done** — `git://f0xx.org/androidcast_project/url-shortener` |
 | Licenses | DEV | Add QR library to BE license inventory when impl starts |
 
 **Safe deploy:** nginx fragment only; no topology changes to router/FE↔BE path. Validate with `nginx -t` before reload.
@@ -343,7 +343,7 @@ Requires PO / infra input (hard blockers for **prod** only):
 
 | ID | Item | Owner | Status |
 |----|------|-------|--------|
-| O1 | Git remote `git://f0xx.org/androicast_project/url-shortener` | PO | **Done** |
+| O1 | Git remote `git://f0xx.org/androidcast_project/url-shortener` | PO | **Done** |
 | O2 | DNS + TLS for `s.f0xx.org` on FE | PO / infra | **Done** |
 | O3 | BE docroot `/var/www/localhost/htdocs/apps/s/` | DEV + PO | **Default in SPEC**; confirm on first sync |
 | O4 | Approve QR library license addition | PO | Open (before QR impl) |

docs/drafts/20100611_3_url_shortener.txt

@@ -101,7 +101,7 @@ is straightforward
 TBD and open questions list:
 
 TODO/DONE list:
-- git OK: git://f0xx.org/androicast_project/url-shortener
+- git OK: git://f0xx.org/androidcast_project/url-shortener
 - SSL OK: (FE) /etc/letsencrypt/live/s.f0xx.org/fullchain.pem, /etc/letsencrypt/live/s.f0xx.org/privkey.pem
 - docs OK: docs/specs/20100611_3_url_shortener.md, docs/DRs/20100611_3_url_shortener.md
 - scaffold OK: backend/url-shortener/ (openapi.yaml, nginx snippets, sql, demo_curl.sh)

docs/specs/20100611_3_url_shortener.md

@@ -6,7 +6,7 @@
 **Status:** Post-alpha (next after alpha); priority may shift with BE capacity/load  
 **Severity:** Medium  
 **Public host:** `https://s.f0xx.org`  
-**Repo placement:** `backend/url-shortener` (git → `git://f0xx.org/androicast_project/url-shortener`)  
+**Repo placement:** `backend/url-shortener` submodule (git → `git://f0xx.org/androidcast_project/url-shortener`)  
 **Scaffold:** [backend/url-shortener/](../../backend/url-shortener/) · **OpenAPI:** [openapi.yaml](../../backend/url-shortener/openapi.yaml)
 
 **Documentation index:** [README.md](../README.md)
@@ -381,7 +381,7 @@ Serve docs at `GET /api/v1/docs` (Swagger UI static bundle or Redoc) — opt-in
 | Item | Value |
 |------|-------|
 | Submodule path | `backend/url-shortener` |
-| Remote | `git://f0xx.org/androicast_project/url-shortener` (live) |
+| Remote | `git://f0xx.org/androidcast_project/url-shortener` (live submodule) |
 | FE TLS | `/etc/letsencrypt/live/s.f0xx.org/` (live on FE) |
 | BE docroot | `/var/www/localhost/htdocs/apps/s/` |
 | nginx | [deploy/nginx.fe-s.f0xx.org.snippet](../../backend/url-shortener/deploy/nginx.fe-s.f0xx.org.snippet), [deploy/nginx.be-url-shortener.fragment](../../backend/url-shortener/deploy/nginx.be-url-shortener.fragment) |