Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/abrp.go

@@ -37,6 +37,8 @@ const (
 	abrpEndpoint = "https://api.iternio.com/1/tlm/send"
 	// Older than this, a sample is history rather than live state, and ABRP gets nothing.
 	abrpMaxAge = 5 * time.Minute
+	// Newer than now by more than this, a sample's clock is wrong, and ABRP gets nothing.
+	abrpMaxAhead = 30 * time.Second
 )
 
 func (f *Forwarder) configured() bool {
@@ -46,16 +48,17 @@ func (f *Forwarder) configured() bool {
 // pick chooses the sample to forward, or false when there is nothing new or it is too
 // soon. It records the choice, so two batches arriving together cannot both forward.
 func (f *Forwarder) pick(samples []TelemetrySample, now time.Time) (TelemetrySample, bool) {
-	if len(samples) == 0 {
-		return TelemetrySample{}, false
-	}
-	newest := samples[0]
-	for _, s := range samples[1:] {
-		if s.UTC > newest.UTC {
-			newest = s
+	// A sample stamped ahead of now has a wrong clock. Taking it would also set lastUTC into
+	// the future, and every real sample after it would look older and never be sent.
+	latest := now.Add(abrpMaxAhead).Unix()
+	var newest TelemetrySample
+	found := false
+	for _, s := range samples {
+		if s.UTC <= latest && (!found || s.UTC > newest.UTC) {
+			newest, found = s, true
 		}
 	}
-	if now.Sub(time.Unix(newest.UTC, 0)) > abrpMaxAge {
+	if !found || now.Sub(time.Unix(newest.UTC, 0)) > abrpMaxAge {
 		return TelemetrySample{}, false
 	}
 	f.mu.Lock()