Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/README.md

@@ -22,8 +22,8 @@ is applied automatically. Apply them yourself.
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing, your ABRP API key and user token) and `grafana-admin`. Keep
-   the template itself on placeholders only.
+   approval password for pairing, your ABRP API key and user token), `grafana-admin` and
+   `grafana-influx` (see below). Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
    secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
 
@@ -38,12 +38,34 @@ kubectl apply -k k8s/
 Use **`-k`**, not `-f k8s/`: plain `-f` applies the files without kustomize, so the Grafana
 ConfigMaps (datasource and dashboards) are never created and Grafana does not start.
 
+## Grafana's InfluxDB token
+
+Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the
+`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own:
+
+1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in
+   as admin:
+
+   ```sh
+   kubectl -n mg4 exec influxdb-0 -- sh -c \
+     'influx auth create --org mg4 --description grafana-read-only --json \
+        --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'
+   ```
+
+2. Copy the `"token"` value from the output into `grafana-influx` → `token` in
+   `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana:
+   `kubectl -n mg4 rollout restart deployment/grafana`.
+
+Until the Secret exists, Grafana does not start (the container waits for the missing Secret).
+On a fresh install, apply everything once without Grafana working, create the token, then
+apply the Secret.
+
 ## Notes
 
 - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
   does not change the token inside InfluxDB.
-- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
-  for Grafana, read/write for the server) can replace it later.
+- The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
+  replace it later. Grafana has its own read-only token (below).
 - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
   ConfigMap name changes with its content, which rolls Grafana.
 - The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its