feat(android): remote portal access — login, stats, trips, dashcam (Phase 28.6)

PLAN.md

@@ -2021,7 +2021,7 @@ tracked in FEATURES.md.
 2. **FEAT-02** — QR / claim-code device pairing flow (medium)
 3. **FEAT-04** — Replace SIM868 2G GSM with 4G LTE modem (large)
 
-### Phase 28: Native Android companion app — 🚧 IN PROGRESS (28.1 ✅, 28.2 ✅, 28.3 ✅, 28.4 ✅, 28.5 ✅, 28.6–28.7 pending)
+### Phase 28: Native Android companion app — 🚧 IN PROGRESS (28.1 ✅, 28.2 ✅, 28.3 ✅, 28.4 ✅, 28.5 ✅, 28.6 ✅, 28.7 pending)
 **Renumbered from former Phase 26 on 2026-08-10 to make room for the road-test bug-fix phase.
 Renumbered to Phase 28 on 2026-08-11 to make room for Phase 27 feature additions. Planning
 completed 2026-08-11. Detailed implementation plan in [android/plan.md](android/plan.md).**
@@ -2212,10 +2212,13 @@ The app reuses the existing Pi REST API surface with no changes:
   with timestamp + speed, and play/pause animation.
 - Deferred: Room offline cache, start/end markers, geocode label under the scrubber.
 
-**28.6 — Remote portal direct access (away from car)**
-- Talk to `https://yaris.ceaf.dev/api/v1/portal/...` directly
-- Browse trip history and dashcam archive from anywhere (not just when connected to Pi)
-- Login with portal credentials (same as Phase 24 web portal login)
+**28.6 — Remote portal direct access ✅ DONE (2026-08-15)**
+- New "Server" tab: CSRF form login to `https://yaris.ceaf.dev` (Flask session cookie via an
+  in-memory `CookieJar`), auto-login on launch with stored credentials.
+- Overview stats card, trip list, and dashcam archive from the portal API; taps open the same
+  `TripReplayScreen` as the Pi (reuses shared DTOs + `TripCard`).
+- Deferred: dashcam video streaming/player, session-cookie persistence across launches (currently
+  re-logs-in each launch), and a server-side tile source for the replay map when off the hotspot.
 
 **28.7 — Polish + distribution**
 - App icon, splash screen, dark theme polish