Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/api_test.go

@@ -116,17 +116,32 @@ func TestEveryOtherEndpointNeedsTheIngestToken(t *testing.T) {
 	}
 }
 
-func TestTelemetryIsStoredAndBadInputIsA400(t *testing.T) {
+func TestTelemetryIsStoredAndBadValuesAreDropped(t *testing.T) {
 	api, store := newTestAPI()
 	h := api.Routes()
 	rec := do(t, h, "POST", "/v1/telemetry", testToken, string(telemetryBody(`{"utc":1790000000,"soc":80}`)))
-	if rec.Code != 204 || len(store.telemetry) != 1 {
-		t.Fatalf("%d, stored %d", rec.Code, len(store.telemetry))
+	if rec.Code != 200 || len(store.telemetry) != 1 || !strings.Contains(rec.Body.String(), `"stored":1`) {
+		t.Fatalf("%d %s, stored %d", rec.Code, rec.Body, len(store.telemetry))
 	}
-	rec = do(t, h, "POST", "/v1/telemetry", testToken, string(telemetryBody(`{"utc":1790000000,"soc":120}`)))
-	if rec.Code != 400 || !strings.Contains(rec.Body.String(), "samples[0].soc is invalid") {
+	// One bad value costs that value, not the batch: the car drops what the server rejects.
+	rec = do(t, h, "POST", "/v1/telemetry", testToken,
+		string(telemetryBody(`{"utc":1790000000,"soc":120,"speed":-3},{"utc":1790000015,"soc":79}`)))
+	if rec.Code != 200 || len(store.telemetry) != 3 || !strings.Contains(rec.Body.String(), "samples[0].soc") ||
+		!strings.Contains(rec.Body.String(), "samples[0].speed") || !strings.Contains(rec.Body.String(), `"stored":2`) {
+		t.Fatalf("%d %s, stored %d", rec.Code, rec.Body, len(store.telemetry))
+	}
+	if _, ok := store.telemetry[1].Numbers["soc"]; ok {
+		t.Fatal("out-of-range soc stored")
+	}
+	// Nothing usable is still a 200: sending it again would not help.
+	rec = do(t, h, "POST", "/v1/telemetry", testToken, string(telemetryBody(`{"utc":5}`)))
+	if rec.Code != 200 || len(store.telemetry) != 3 || !strings.Contains(rec.Body.String(), `"stored":0`) {
 		t.Fatalf("%d %s", rec.Code, rec.Body)
 	}
+	// A malformed request is still a 400.
+	if rec := do(t, h, "POST", "/v1/telemetry", testToken, `{"installationId":"nope","samples":[]}`); rec.Code != 400 {
+		t.Fatalf("malformed: %d", rec.Code)
+	}
 	if rec := do(t, h, "GET", "/v1/telemetry", testToken, ""); rec.Code != 405 {
 		t.Fatalf("GET on a POST route: want 405, got %d", rec.Code)
 	}