Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -112,6 +112,22 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in
   the now gitignored `k8s/secrets.yaml` (since moved to `k8s/secrets/secrets.yaml`, outside
   `kubectl apply -f k8s/`). Filled-in secrets live only there from now on.
+- 2026-10-18 — Code review fixes. App 2.9.0, server 2.2.0, Grafana token:
+  - The server drops a bad value (or a sample without a plausible time) instead of rejecting
+    the batch, and answers 200 with what it dropped; the app sends only values within the
+    server's ranges (speed as a magnitude) and no samples before its clock is set. Before, one
+    reversing sample cost the whole queued batch.
+  - Pairing: the token is handed out and accepted only after the device is saved; wrong-password
+    lockouts and open-request limits are per client address; a paired token only serves its
+    own installation id (403 otherwise).
+  - ABRP forwarding skips samples stamped ahead of the server's clock, which used to block it.
+  - App: settings written in plaintext during a keystore failure move back into encrypted
+    storage; the installation id is derived from ANDROID_ID, so a reinstall keeps its history;
+    the imported config file is deleted; GPS stops when live telemetry is off and pauses while
+    parked and idle; range estimates use the monotonic clock; one HTTP helper (`ServerHttp`)
+    for all server calls; the last Turkish strings translated.
+  - Grafana reads InfluxDB with its own read-only token (`grafana-influx` Secret, created by
+    hand: `k8s/README.md`).
 - 2026-10-18 — README rewritten for Nils' MG4. `OTA.md`, `mise.toml` and
   `docs/MG4_PLATFORM_INSTALL.md` use the new package ID and `NilsMG4-*.apk` names; `OTA.md` notes
   that updates are switched off. `CHANGELOG.md` keeps the old ID as upstream history.