Add phone-relay dashcam upload to bypass the Pi's slow WiFi

Root-caused the slow-upload complaint to the Pi's own congested 2.4GHz
WiFi radio (confirmed via iperf3 - same degraded throughput even on
pure local LAN traffic, ruling out Cloudflare/ISP). Since the Pi 3 B
has no 5GHz radio, add a way to bypass it for the internet-bound leg:
a phone opens /dash and manually relays pending dashcam files straight
to the remote server over its own network, reusing the exact same
chunked upload protocol the Pi's client already uses.

- server/app.py: add CORS headers (after_request) so the phone's
  browser can call the remote server cross-origin from a page served
  by the Pi.
- app.py: new endpoints - GET /api/dash/pending (list not-yet-uploaded
  files), GET /api/dash/file/<path> (Range-request-capable download,
  path-traversal safe), GET /api/dash/relay/config (hands the phone
  the device credentials), POST /api/dash/relay/heartbeat|stop (lease-
  based pause of the Pi's own background uploader, self-heals if the
  phone's tab closes uncleanly), POST /api/dash/relay/mark_uploaded.
- modules/app_upload.py: list_pending_dashcam_files(), relay lease
  helpers, _upload_dashcam_files() now pauses while a relay lease is
  active.
- modules/app_sql.py: new dashcam_hash_cache table so a file's sha256
  is only computed once (keyed by path+size+mtime) instead of being
  recomputed on every loop iteration/pending-list call - benefits the
  existing background uploader too.
- templates/dash.html / static/js/dash.js: new "Relay via phone" card
  - per-file and "relay all" buttons (manual trigger only, per user
  preference), downloads+uploads one 40MB slice at a time so the
  phone never holds a whole file in memory, retries chunks up to 3x.
- PLAN.md/readme.md/server/README.md updated (Phase 11).

Tested via a full local end-to-end simulation driving the real Pi and
server Flask apps side by side (Postgres mocked only at the db module
boundary - all HTTP/chunking/auth/CORS logic is real): verified Range
downloads (206), byte-for-byte reassembly via SHA256, path-traversal
rejection, and the relay lease correctly pausing/resuming the
background uploader. Not yet tested against a real phone/live network.

readme.md

@@ -42,6 +42,9 @@ i have a dream
   Dashcam videos upload in resumable 40MB chunks (works around tunnel body-size limits and keeps
   the Pi's memory footprint flat regardless of file size); a UI toggle can pause dashcam uploads
   independently while trip logs keep syncing
+- 📱 **Phone-relay upload** — if the Pi's own WiFi is slow/congested, open `/dash` on your phone
+  to download pending dashcam files locally and re-upload them straight to the remote server
+  using the phone's own network instead, automatically pausing the Pi's own upload meanwhile
 - 🗄️ Local SQLite trip logging, retried/synced to the remote server with automatic backoff
 - 🔌 Runs fully headless as a `systemd` service, autostarting on boot
 
@@ -75,8 +78,9 @@ For the remote server (receives trip logs + dashcam uploads), see [server/README
 
 ## Project status
 
-This project was revived after a couple of years on the shelf. All 10 planned phases are done and
-the full pipeline — OBD/GPS logging, offline web UI, WiFi hotspot, dashcam retrieval, and remote
-upload — has been verified against real hardware end-to-end, including a full real dashcam import
-and upload run. Only the SIM868 cellular fallback (for uploading while out of WiFi range) remains
-untested, pending a SIM card. Full phase-by-phase history in [PLAN.md](./PLAN.md).
+This project was revived after a couple of years on the shelf. All 11 planned phases are done and
+the full pipeline — OBD/GPS logging, offline web UI, WiFi hotspot, dashcam retrieval, remote
+upload, and phone-relay upload — has been verified against real hardware end-to-end, including a
+full real dashcam import and upload run. Only the SIM868 cellular fallback (for uploading while
+out of WiFi range) and the phone-relay feature's real-phone/live-network test remain untested.
+Full phase-by-phase history in [PLAN.md](./PLAN.md).