Add phone-relay dashcam upload to bypass the Pi's slow WiFi

Root-caused the slow-upload complaint to the Pi's own congested 2.4GHz
WiFi radio (confirmed via iperf3 - same degraded throughput even on
pure local LAN traffic, ruling out Cloudflare/ISP). Since the Pi 3 B
has no 5GHz radio, add a way to bypass it for the internet-bound leg:
a phone opens /dash and manually relays pending dashcam files straight
to the remote server over its own network, reusing the exact same
chunked upload protocol the Pi's client already uses.

- server/app.py: add CORS headers (after_request) so the phone's
  browser can call the remote server cross-origin from a page served
  by the Pi.
- app.py: new endpoints - GET /api/dash/pending (list not-yet-uploaded
  files), GET /api/dash/file/<path> (Range-request-capable download,
  path-traversal safe), GET /api/dash/relay/config (hands the phone
  the device credentials), POST /api/dash/relay/heartbeat|stop (lease-
  based pause of the Pi's own background uploader, self-heals if the
  phone's tab closes uncleanly), POST /api/dash/relay/mark_uploaded.
- modules/app_upload.py: list_pending_dashcam_files(), relay lease
  helpers, _upload_dashcam_files() now pauses while a relay lease is
  active.
- modules/app_sql.py: new dashcam_hash_cache table so a file's sha256
  is only computed once (keyed by path+size+mtime) instead of being
  recomputed on every loop iteration/pending-list call - benefits the
  existing background uploader too.
- templates/dash.html / static/js/dash.js: new "Relay via phone" card
  - per-file and "relay all" buttons (manual trigger only, per user
  preference), downloads+uploads one 40MB slice at a time so the
  phone never holds a whole file in memory, retries chunks up to 3x.
- PLAN.md/readme.md/server/README.md updated (Phase 11).

Tested via a full local end-to-end simulation driving the real Pi and
server Flask apps side by side (Postgres mocked only at the db module
boundary - all HTTP/chunking/auth/CORS logic is real): verified Range
downloads (206), byte-for-byte reassembly via SHA256, path-traversal
rejection, and the relay lease correctly pausing/resuming the
background uploader. Not yet tested against a real phone/live network.

modules/app_sql.py

@@ -57,6 +57,18 @@ SQL_CREATE_DASHCAM_UPLOADS_TABLE = """CREATE TABLE IF NOT EXISTS dashcam_uploads
                                 UNIQUE(RELATIVE_PATH, SHA256)
                             );"""
 
+# Cache of already-computed sha256 hashes, keyed by (path, size, mtime) so a
+# file's hash never needs recomputing once copied from the dashcam (its size
+# and mtime won't change afterward). Avoids re-hashing the entire, possibly
+# 20GB+, local backlog on every background-upload loop iteration and every
+# "pending files" list request from the phone-relay feature.
+SQL_CREATE_DASHCAM_HASH_CACHE_TABLE = """CREATE TABLE IF NOT EXISTS dashcam_hash_cache (
+                                RELATIVE_PATH text PRIMARY KEY,
+                                SIZE integer NOT NULL,
+                                MTIME real NOT NULL,
+                                SHA256 text NOT NULL
+                            );"""
+
 
 def create_conn(db_file):
     """Open a SQLite connection to db_file, creating its parent folder if needed.
@@ -98,6 +110,7 @@ def get_conn():
             create_table(_conn, SQL_CREATE_DTC_TABLE)
             create_table(_conn, SQL_CREATE_SETTINGS_TABLE)
             create_table(_conn, SQL_CREATE_DASHCAM_UPLOADS_TABLE)
+            create_table(_conn, SQL_CREATE_DASHCAM_HASH_CACHE_TABLE)
             _migrate_tracking_table(_conn)
         else:
             print("Error! cannot create the database connection.")
@@ -221,6 +234,34 @@ def mark_dashcam_file_uploaded(relative_path, sha256):
         conn.commit()
 
 
+def get_cached_dashcam_hash(relative_path, size, mtime):
+    """Return a previously-computed sha256 for this exact (path, size, mtime),
+    or None if not cached / the file has changed since it was last hashed."""
+    conn = get_conn()
+    if conn is None:
+        return None
+    with _conn_lock:
+        cur = conn.execute(
+            "SELECT SHA256 FROM dashcam_hash_cache WHERE RELATIVE_PATH = ? AND SIZE = ? AND MTIME = ?",
+            (relative_path, size, mtime),
+        )
+        row = cur.fetchone()
+    return row[0] if row is not None else None
+
+
+def set_cached_dashcam_hash(relative_path, size, mtime, sha256):
+    conn = get_conn()
+    if conn is None:
+        return
+    with _conn_lock:
+        conn.execute(
+            "INSERT INTO dashcam_hash_cache (RELATIVE_PATH, SIZE, MTIME, SHA256) VALUES (?, ?, ?, ?) "
+            "ON CONFLICT(RELATIVE_PATH) DO UPDATE SET SIZE = excluded.SIZE, MTIME = excluded.MTIME, SHA256 = excluded.SHA256",
+            (relative_path, size, mtime, sha256),
+        )
+        conn.commit()
+
+
 def _log_loop():
     # Deferred import to avoid a circular import at module load time
     # (app_obd.py imports app_sql, and app_sql needs app_obd.speed here).