Add phone-relay dashcam upload to bypass the Pi's slow WiFi

Root-caused the slow-upload complaint to the Pi's own congested 2.4GHz
WiFi radio (confirmed via iperf3 - same degraded throughput even on
pure local LAN traffic, ruling out Cloudflare/ISP). Since the Pi 3 B
has no 5GHz radio, add a way to bypass it for the internet-bound leg:
a phone opens /dash and manually relays pending dashcam files straight
to the remote server over its own network, reusing the exact same
chunked upload protocol the Pi's client already uses.

- server/app.py: add CORS headers (after_request) so the phone's
  browser can call the remote server cross-origin from a page served
  by the Pi.
- app.py: new endpoints - GET /api/dash/pending (list not-yet-uploaded
  files), GET /api/dash/file/<path> (Range-request-capable download,
  path-traversal safe), GET /api/dash/relay/config (hands the phone
  the device credentials), POST /api/dash/relay/heartbeat|stop (lease-
  based pause of the Pi's own background uploader, self-heals if the
  phone's tab closes uncleanly), POST /api/dash/relay/mark_uploaded.
- modules/app_upload.py: list_pending_dashcam_files(), relay lease
  helpers, _upload_dashcam_files() now pauses while a relay lease is
  active.
- modules/app_sql.py: new dashcam_hash_cache table so a file's sha256
  is only computed once (keyed by path+size+mtime) instead of being
  recomputed on every loop iteration/pending-list call - benefits the
  existing background uploader too.
- templates/dash.html / static/js/dash.js: new "Relay via phone" card
  - per-file and "relay all" buttons (manual trigger only, per user
  preference), downloads+uploads one 40MB slice at a time so the
  phone never holds a whole file in memory, retries chunks up to 3x.
- PLAN.md/readme.md/server/README.md updated (Phase 11).

Tested via a full local end-to-end simulation driving the real Pi and
server Flask apps side by side (Postgres mocked only at the db module
boundary - all HTTP/chunking/auth/CORS logic is real): verified Range
downloads (206), byte-for-byte reassembly via SHA256, path-traversal
rejection, and the relay lease correctly pausing/resuming the
background uploader. Not yet tested against a real phone/live network.

app.py

@@ -1,4 +1,7 @@
-from flask import Flask, render_template, make_response, json, jsonify, request
+import os
+
+from flask import Flask, render_template, make_response, json, jsonify, request, send_file, abort
+from werkzeug.utils import safe_join
 from modules import app_gps, app_events, app_car, app_account, app_gps,app_obd, app_sql, app_dash, app_upload
 import time
 from gevent.pywsgi import WSGIServer
@@ -50,6 +53,60 @@ def upload_dashcam_toggle():
     app_upload.set_dashcam_upload_enabled(bool(body["enabled"]))
     return jsonify(app_upload.get_status())
 
+# --- Phone-relay: lets a phone on the Pi's own network list, download, and
+# directly re-upload dashcam files to the remote server itself (bypassing
+# the Pi's own often-congested WiFi radio for the internet-bound leg). See
+# static/js/dash.js for the client side of this. ---
+
+@app.route('/api/dash/pending')
+def dash_pending():
+    return jsonify({"files": app_upload.list_pending_dashcam_files()})
+
+@app.route('/api/dash/file/<path:relpath>')
+def dash_file(relpath):
+    abs_path = safe_join(app_dash.DEFAULT_DESTINATION, relpath)
+    if abs_path is None or not os.path.isfile(abs_path):
+        abort(404)
+    # conditional=True (Flask's default) makes this support Range requests,
+    # so the phone can fetch/re-upload one chunk at a time instead of ever
+    # holding the whole (300+MB) file in the browser's memory at once.
+    return send_file(abs_path, mimetype='application/octet-stream', conditional=True)
+
+@app.route('/api/dash/relay/config')
+def dash_relay_config():
+    # Hands the phone the same device credentials the Pi's own upload client
+    # uses, so its browser JS can call the remote server's existing chunked
+    # upload endpoints directly. Same trust boundary as the rest of this
+    # unauthenticated local UI - anyone on the Pi's hotspot/LAN is already
+    # implicitly trusted.
+    return jsonify({
+        "server_url": app_upload.SERVER_URL,
+        "device_name": app_upload.DEVICE_NAME,
+        "api_key": app_upload.API_KEY,
+        "chunk_size": app_upload.DASHCAM_CHUNK_SIZE,
+        "configured": app_upload.is_configured(),
+    })
+
+@app.route('/api/dash/relay/heartbeat', methods=['POST'])
+def dash_relay_heartbeat():
+    app_upload.relay_heartbeat()
+    return jsonify(app_upload.get_status())
+
+@app.route('/api/dash/relay/stop', methods=['POST'])
+def dash_relay_stop():
+    app_upload.relay_stop()
+    return jsonify(app_upload.get_status())
+
+@app.route('/api/dash/relay/mark_uploaded', methods=['POST'])
+def dash_relay_mark_uploaded():
+    body = request.get_json(silent=True) or {}
+    relative_path = (body.get("relative_path") or "").strip()
+    sha256 = (body.get("sha256") or "").strip().lower()
+    if not relative_path or not sha256:
+        return jsonify(error="expected JSON body {'relative_path', 'sha256'}"), 400
+    app_sql.mark_dashcam_file_uploaded(relative_path, sha256)
+    return jsonify(status="ok")
+
 # not sure if im gonna use this
 @app.route('/api/obd_speed/')
 def data():