App 2.3.0: Server tab, live telemetry to the car server

- New Server tab: server URL, ingest token and installation id, with
  Save, Test connection (health, then a read-only token check) and the
  config-file import that upstream removed (app folder / USB stick first,
  document picker as fallback). Settings are kept encrypted and read on
  every use, so the service picks up a change without a restart. Each
  installation generates its own id; the inherited upstream UUID and
  the baked-in CONSUMPTION_API_* build fields are gone.
- Live telemetry restored from before ea8032a (TelemetryPayload,
  UploadCadence, UploadSettings, GPS) and sent in batches to
  POST /v1/telemetry instead of ABRP; the server forwards to ABRP. Adds
  ext_temp, voltage and current. Unsent samples queue in memory (about
  8 h) while offline.
- Upload tab: the live-telemetry switch and cadence controls work again;
  the dead service and autostart switches are removed.
- Manifest: location permissions and foreground service types.
- Unit tests compile again: 114 (stable) / 136 (unstable) pass. Tests
  for the deleted AbrpApi and HeadUnitWeather removed; new tests for
  ServerConfig and TelemetryQueue. Lint passes.

Not yet tried on the car.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/src/test/java/com/evsuite/abrp/ServerConfigTest.java

@@ -0,0 +1,47 @@
+package com.evsuite.abrp;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+/** What the Server tab and the config import accept — pure JVM. */
+public class ServerConfigTest {
+
+    @Test
+    public void urlIsTrimmedAndLosesTrailingSlashes() {
+        assertEquals("https://car.example.com", ServerConfig.normalizeUrl("  https://car.example.com//  "));
+        assertEquals("https://car.example.com/base", ServerConfig.normalizeUrl("https://car.example.com/base/"));
+    }
+
+    @Test
+    public void plainHttpAndJunkAreRefused() {
+        // The token travels in a header; over plain http anyone on the hotspot could read it.
+        assertNull(ServerConfig.normalizeUrl("http://car.example.com"));
+        assertNull(ServerConfig.normalizeUrl("car.example.com"));
+        assertNull(ServerConfig.normalizeUrl("https://"));
+        assertNull(ServerConfig.normalizeUrl("https:///path"));
+        assertNull(ServerConfig.normalizeUrl("https://user@car.example.com"));
+        assertNull(ServerConfig.normalizeUrl("https://car.example.com/?x=1"));
+        assertNull(ServerConfig.normalizeUrl(null));
+    }
+
+    @Test
+    public void tokenMustMeetTheServersMinimum() {
+        assertTrue(ServerConfig.isValidToken("0123456789abcdef01234567"));
+        assertFalse(ServerConfig.isValidToken("too-short"));
+        assertFalse(ServerConfig.isValidToken("0123456789abcdef 01234567"));
+        assertFalse(ServerConfig.isValidToken(null));
+    }
+
+    @Test
+    public void installationIdMustBeAUuidTheServerAccepts() {
+        assertTrue(ServerConfig.isValidInstallationId("6f1a2b3c-4d5e-4f60-8a9b-0c1d2e3f4a5b"));
+        assertTrue(ServerConfig.isValidInstallationId(java.util.UUID.randomUUID().toString()));
+        assertFalse(ServerConfig.isValidInstallationId("6f1a2b3c-4d5e-0f60-8a9b-0c1d2e3f4a5b")); // version 0
+        assertFalse(ServerConfig.isValidInstallationId("not-a-uuid"));
+        assertFalse(ServerConfig.isValidInstallationId(""));
+    }
+}