Replace the Express service with a Next.js app on Vercel

The standalone service in server/ was never deployed anywhere, and keeping it
alongside a Vercel app would mean maintaining two implementations of the same
validation rules. It is deleted; web/ is the only ingest path now. Its routes
live at /v1/... rather than under /api, so the Android client's URL building is
unchanged and CONSUMPTION_API_URL stays a bare origin.

Credentials are split in two. INGEST_TOKEN is baked into the published APK and
must be assumed extractable — anyone can unzip an APK and read its strings — so
it opens the PUT endpoints and nothing else. Reading the history needs the
dashboard password, which is never compiled into anything and reaches the
browser as an HMAC-signed httpOnly cookie. The MongoDB URI stays a server-side
environment variable; the car has never held one and still does not.

The dashboard is a phone-shaped reader for the same data: totals for energy
taken and paid, a daily energy chart, an efficiency trend, and every DC session
with its power/SOC curve. It reuses the head unit's OLED palette so the two read
as one app. Every page is a server component and the charts are hand-rolled SVG,
so the whole thing renders without shipping client JavaScript.

MongoClient is cached on globalThis: a fresh client per request means a fresh
pool per request, and Atlas starts refusing connections long before the traffic
would justify it. Index creation moved to the first write of each warm lambda,
since a serverless deployment has no boot step to hang it on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/src/app/api/session/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { SESSION_COOKIE, checkDashboardPassword, issueSessionValue, sessionCookieOptions } from "@/lib/auth";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Deliberately slow to fail. The password is the only thing between the open internet and
+ * the history, and a quarter second is unnoticeable once but ruinous for anyone working
+ * through a list.
+ */
+export async function POST(request: Request) {
+  const form = await request.formData();
+  const password = String(form.get("password") ?? "");
+  if (!checkDashboardPassword(password)) {
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    return NextResponse.redirect(new URL("/login?error=1", request.url), { status: 303 });
+  }
+  const store = await cookies();
+  store.set(SESSION_COOKIE, issueSessionValue(), sessionCookieOptions);
+  return NextResponse.redirect(new URL("/", request.url), { status: 303 });
+}