feat(android): remote portal access — login, stats, trips, dashcam (Phase 28.6)

android/plan.md

@@ -203,26 +203,29 @@ android/
 - [x] Trip stats header: distance, duration, avg speed, max speed
 - [ ] Start/end markers + geocode label below scrubber — deferred
 
-### 28.6 — Remote portal direct access ⬜ NOT STARTED
+### 28.6 — Remote portal direct access ✅ DONE (2026-08-15)
 **Depends on: 28.1 (credentials). Independent of 28.2–28.5. Stretch goal.**
 
-#### 28.6.1 — Auth + data layer
-- [ ] Retrofit interface for server portal:
-  - `POST /login` → session cookie (or token)
-  - `GET /api/v1/portal/stats` → overview stats
-  - `GET /api/v1/portal/trips` → trip list
-  - `GET /api/v1/portal/trip/{id}` → trip route
-  - `GET /api/v1/portal/dashcam` → dashcam file list
-  - `GET /api/v1/portal/dashcam/stream/{id}` → video stream
-- [ ] Session persistence: store cookie/token in EncryptedSharedPreferences
-- [ ] Commit: `feat: server portal data layer`
+#### 28.6.1 — Auth + data layer ✅
+- [x] `PortalApi` (Retrofit) for the server portal:
+  - `GET /api/v1/portal/stats` → `PortalStats`
+  - `GET /api/v1/portal/trips` → `List<PortalTripSummary>` (mapped to shared `TripSummary`)
+  - `GET /api/v1/portal/trip/{id}` → `TripRoute` (reuses `RoutePoint`)
+  - `GET /api/v1/portal/dashcam` → `List<PortalDashcamFile>`
+  - `GET/POST /api/geocode` + batch (server-side reverse geocoder)
+- [x] `PortalViewModel` with CSRF form login (`GET /login` → parse token → `POST /login`)
+      + in-memory `CookieJar` for the Flask session cookie, 401 → auto "session expired"
+- [x] Portal credentials (username/password) stored in `CredentialStore` (SharedPreferences);
+      auto-login on launch when present
+- [ ] Dashcam video streaming/player — deferred (list only for now)
 
-#### 28.6.2 — Portal screens
-- [ ] Reuse trip list + route replay composables from 28.5 (same data shape)
-- [ ] Reuse dashcam list + player composables (server serves same JSON shape as Pi)
-- [ ] Login screen (if not already authenticated)
-- [ ] "Connected to car" vs "Connected to server" mode indicator
-- [ ] Commit: `feat: remote portal screens`
+#### 28.6.2 — Portal screens ✅
+- [x] New "Server" tab: login form → overview stats + trip list + dashcam archive
+- [x] Reuses `TripCard` + `TripReplayScreen` from 28.5 (server serves the same route shape)
+- [x] "Connected to server" indicator + server URL + logout
+- [x] Tapping a server trip opens the same replay screen with an online CartoDB basemap
+      (`PORTAL_TILE_URL`, zoom 0–19) so it works over cellular away from the hotspot
+- [ ] Video playback (stream endpoint) — deferred
 
 ### 28.7 — Polish + distribution ⬜ NOT STARTED
 **Depends on: 28.1–28.6 (whichever subset ships).**