Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/validate.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"math"
 	"regexp"
+	"sort"
 	"time"
 )
 
@@ -252,8 +253,13 @@ func validateChargingSession(body []byte, pathSessionID string) (ChargingSession
 
 // validateTelemetryBatch checks a batch of live samples in ABRP's tlm field names and
 // units. Unknown fields are dropped rather than rejected, so a newer app can add one
-// without a server release; every known field is bounded; a flag may be 0/1 or a boolean.
-func validateTelemetryBatch(body []byte) (TelemetryBatch, error) {
+// without a server release; a flag may be 0/1 or a boolean.
+//
+// Only a malformed request is a 400. A bad value inside a sample costs that value, and a
+// sample without a usable time costs that sample: the car drops a batch the server
+// rejects, and one sensor reading out of range must not take hours of queued driving with
+// it. What was dropped is listed in Dropped, for the response and the log.
+func validateTelemetryBatch(body []byte, now time.Time) (TelemetryBatch, error) {
 	o, err := decodeObject(body)
 	if err != nil {
 		return TelemetryBatch{}, err
@@ -266,34 +272,45 @@ func validateTelemetryBatch(body []byte) (TelemetryBatch, error) {
 	if !ok || len(raw) == 0 || len(raw) > maxSamples {
 		return TelemetryBatch{}, invalid("samples is invalid")
 	}
-	samples := make([]TelemetrySample, 0, len(raw))
+	batch := TelemetryBatch{InstallationID: id, Samples: make([]TelemetrySample, 0, len(raw))}
+	latest := now.Add(maxClockAhead).Unix()
 	for i, entry := range raw {
-		sample, err := validateSample(entry, fmt.Sprintf("samples[%d]", i))
-		if err != nil {
-			return TelemetryBatch{}, err
+		name := fmt.Sprintf("samples[%d]", i)
+		sample, dropped, ok := validateSample(entry, name, latest)
+		batch.Dropped = append(batch.Dropped, dropped...)
+		if ok {
+			batch.Samples = append(batch.Samples, sample)
 		}
-		samples = append(samples, sample)
 	}
-	return TelemetryBatch{InstallationID: id, Samples: samples}, nil
+	return batch, nil
 }
 
-func validateSample(entry any, name string) (TelemetrySample, error) {
+// maxClockAhead is how far in the future a sample may be stamped. The head unit sets its
+// clock from GPS; a sample from further ahead has a wrong time, and stored there it would
+// pose as the car's latest state until that time came.
+const maxClockAhead = time.Hour
+
+// validateSample keeps every valid field of one sample. It returns false when the sample
+// as a whole is unusable: not an object, or no plausible time. dropped names what was left
+// out.
+func validateSample(entry any, name string, latestUTC int64) (sample TelemetrySample, dropped []string, ok bool) {
 	o, err := asObject(entry, name)
 	if err != nil {
-		return TelemetrySample{}, err
+		return TelemetrySample{}, []string{name}, false
 	}
 	utc, err := integer(o["utc"], name+".utc")
-	if err != nil || utc < utcMin || utc > utcMax {
-		return TelemetrySample{}, invalid("%s.utc is invalid", name)
+	if err != nil || utc < utcMin || utc > utcMax || utc > latestUTC {
+		return TelemetrySample{}, []string{name + ".utc"}, false
 	}
-	sample := TelemetrySample{UTC: utc, Numbers: map[string]float64{}, Flags: map[string]bool{}}
+	sample = TelemetrySample{UTC: utc, Numbers: map[string]float64{}, Flags: map[string]bool{}}
 	for field, limits := range telemetryNumbers {
 		if !o.has(field) {
 			continue
 		}
 		f, err := bounded(o[field], limits[0], limits[1], name+"."+field)
 		if err != nil {
-			return TelemetrySample{}, err
+			dropped = append(dropped, name+"."+field)
+			continue
 		}
 		sample.Numbers[field] = f
 	}
@@ -311,17 +328,20 @@ func validateSample(entry any, name string) (TelemetrySample, error) {
 			case "0":
 				sample.Flags[field] = false
 			default:
-				return TelemetrySample{}, invalid("%s.%s is invalid", name, field)
+				dropped = append(dropped, name+"."+field)
 			}
 		default:
-			return TelemetrySample{}, invalid("%s.%s is invalid", name, field)
+			dropped = append(dropped, name+"."+field)
 		}
 	}
 	// A position is only a position as a pair.
 	_, hasLat := sample.Numbers["lat"]
 	_, hasLon := sample.Numbers["lon"]
 	if hasLat != hasLon {
-		return TelemetrySample{}, invalid("%s.lat and lon must be sent together", name)
+		delete(sample.Numbers, "lat")
+		delete(sample.Numbers, "lon")
+		dropped = append(dropped, name+".lat/lon")
 	}
-	return sample, nil
+	sort.Strings(dropped)
+	return sample, dropped, true
 }