App 2.12.0, server 2.5.0: enter settings on the phone

The ABRP credentials are long to type on the car. "Enter on phone"
(Live data tab, and Settings next to the charging price) shows a QR
code; it opens a form on the server where the phone sends the ABRP API
key and user token, charging price and usable capacity, confirmed with
the approval password. The car polls with its own token and collects
the values once, then saves them through the same checks as the fields
on screen.

Same device-flow shape as pairing. The server keeps the values in memory
only, at most ten minutes, hands them out once with no-store, and never
logs them or puts them back into the page; a paired token only reaches
its own installation's request. Pairing's QR dialog is now shared
(PhoneQrDialog), and the phone pages share one stylesheet.

The config file also takes charging_price and usable_kwh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/README.md

@@ -43,6 +43,17 @@ with (403 otherwise); the shared token works for any.
 
 A malformed request is a 400 naming the field; a database failure is a 500 without detail.
 
+## Settings from a phone
+
+The ABRP credentials are long to type on the car. With pairing on, the car (with its own token)
+opens `POST /v1/settings/start` `{installationId}` and shows `verificationUriComplete` as a QR
+code. The phone fills in the form at `/settings?code=…` (ABRP API key and user token, charging
+price, usable capacity; empty fields are left alone) and sends it with the approval password.
+The car polls `POST /v1/settings/poll` `{deviceCode}`: 202 pending, 200 with the values (handed
+out once, `Cache-Control: no-store`), 410 expired or unknown. A paired token only reaches its own
+installation's request. The values live in memory only, at most ten minutes, and are never
+stored, logged or put back into the page.
+
 ## Pairing a car by QR code
 
 So nobody types a token in the car. Modelled on the OAuth device authorization grant (RFC 8628);