Replace the Express service with a Next.js app on Vercel

The standalone service in server/ was never deployed anywhere, and keeping it
alongside a Vercel app would mean maintaining two implementations of the same
validation rules. It is deleted; web/ is the only ingest path now. Its routes
live at /v1/... rather than under /api, so the Android client's URL building is
unchanged and CONSUMPTION_API_URL stays a bare origin.

Credentials are split in two. INGEST_TOKEN is baked into the published APK and
must be assumed extractable — anyone can unzip an APK and read its strings — so
it opens the PUT endpoints and nothing else. Reading the history needs the
dashboard password, which is never compiled into anything and reaches the
browser as an HMAC-signed httpOnly cookie. The MongoDB URI stays a server-side
environment variable; the car has never held one and still does not.

The dashboard is a phone-shaped reader for the same data: totals for energy
taken and paid, a daily energy chart, an efficiency trend, and every DC session
with its power/SOC curve. It reuses the head unit's OLED palette so the two read
as one app. Every page is a server component and the charts are hand-rolled SVG,
so the whole thing renders without shipping client JavaScript.

MongoClient is cached on globalThis: a fresh client per request means a fresh
pool per request, and Atlas starts refusing connections long before the traffic
would justify it. Index creation moved to the first write of each warm lambda,
since a serverless deployment has no boot step to hang it on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/src/app/v1/consumption/daily/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from "next/server";
+import { handle, parseJson, requireIngest } from "@/lib/api";
+import { consumptionCollection, ensureIndexes } from "@/lib/mongo";
+import { validateConsumption } from "@/lib/validate";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Upsert on (installationId, date). The car retries a day it could not confirm, so the
+ * same day arrives more than once and must land on the same document rather than a
+ * duplicate — the unique index is what guarantees that under a concurrent retry.
+ */
+export async function PUT(request: Request) {
+  const denied = requireIngest(request);
+  if (denied) return denied;
+  return handle(async () => {
+    const record = validateConsumption(await parseJson(request));
+    await ensureIndexes();
+    const collection = await consumptionCollection();
+    const updatedAt = new Date();
+    await collection.updateOne(
+      { installationId: record.installationId, date: record.date },
+      { $set: { ...record, updatedAt }, $setOnInsert: { createdAt: updatedAt } },
+      { upsert: true },
+    );
+    return new NextResponse(null, { status: 204 });
+  });
+}