Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/README.md

@@ -22,8 +22,8 @@ is applied automatically. Apply them yourself.
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing, your ABRP API key and user token) and `grafana-admin`. Keep
-   the template itself on placeholders only.
+   approval password for pairing, your ABRP API key and user token), `grafana-admin` and
+   `grafana-influx` (see below). Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
    secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
 
@@ -38,12 +38,34 @@ kubectl apply -k k8s/
 Use **`-k`**, not `-f k8s/`: plain `-f` applies the files without kustomize, so the Grafana
 ConfigMaps (datasource and dashboards) are never created and Grafana does not start.
 
+## Grafana's InfluxDB token
+
+Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the
+`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own:
+
+1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in
+   as admin:
+
+   ```sh
+   kubectl -n mg4 exec influxdb-0 -- sh -c \
+     'influx auth create --org mg4 --description grafana-read-only --json \
+        --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'
+   ```
+
+2. Copy the `"token"` value from the output into `grafana-influx` → `token` in
+   `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana:
+   `kubectl -n mg4 rollout restart deployment/grafana`.
+
+Until the Secret exists, Grafana does not start (the container waits for the missing Secret).
+On a fresh install, apply everything once without Grafana working, create the token, then
+apply the Secret.
+
 ## Notes
 
 - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
   does not change the token inside InfluxDB.
-- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
-  for Grafana, read/write for the server) can replace it later.
+- The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
+  replace it later. Grafana has its own read-only token (below).
 - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
   ConfigMap name changes with its content, which rolls Grafana.
 - The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its

k8s/grafana.yaml

@@ -71,11 +71,13 @@ spec:
             # Read by datasources.yaml.
             - name: INFLUX_URL
               value: http://influxdb.mg4.svc:8086
+            # Read-only on the mg4 bucket; the dashboards never write (README, "Grafana's
+            # InfluxDB token").
             - name: INFLUX_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: influxdb-auth
-                  key: admin-token
+                  name: grafana-influx
+                  key: token
           volumeMounts:
             - name: data
               mountPath: /var/lib/grafana

k8s/secrets/secrets.example.yaml

@@ -41,3 +41,14 @@ stringData:
   # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
   # afterwards, or reset it with grafana cli.
   admin-password: CHANGE-ME
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-influx
+  namespace: mg4
+type: Opaque
+stringData:
+  # A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it;
+  # the command is in k8s/README.md ("Grafana's InfluxDB token").
+  token: CHANGE-ME-read-only-token-from-influx-auth-create

k8s/server.yaml

@@ -29,8 +29,8 @@ spec:
           type: RuntimeDefault
       containers:
         - name: server
-          # 2.1.0, pinned by digest so a re-pushed tag cannot change what runs.
-          image: git.stinnesbeck.com/nils/mg4-server@sha256:e5f6e2d2ef9dc2650055a0823a3f86d8903e46918a76e990540482edf819766d
+          # 2.2.0, pinned by digest so a re-pushed tag cannot change what runs.
+          image: git.stinnesbeck.com/nils/mg4-server@sha256:09eb151ff65300b3990a74063cc44a14d24bef810461e4e0e63451cfbcfd8258
           ports:
             - name: http
               containerPort: 8080