Add phone-relay dashcam upload to bypass the Pi's slow WiFi

Root-caused the slow-upload complaint to the Pi's own congested 2.4GHz
WiFi radio (confirmed via iperf3 - same degraded throughput even on
pure local LAN traffic, ruling out Cloudflare/ISP). Since the Pi 3 B
has no 5GHz radio, add a way to bypass it for the internet-bound leg:
a phone opens /dash and manually relays pending dashcam files straight
to the remote server over its own network, reusing the exact same
chunked upload protocol the Pi's client already uses.

- server/app.py: add CORS headers (after_request) so the phone's
  browser can call the remote server cross-origin from a page served
  by the Pi.
- app.py: new endpoints - GET /api/dash/pending (list not-yet-uploaded
  files), GET /api/dash/file/<path> (Range-request-capable download,
  path-traversal safe), GET /api/dash/relay/config (hands the phone
  the device credentials), POST /api/dash/relay/heartbeat|stop (lease-
  based pause of the Pi's own background uploader, self-heals if the
  phone's tab closes uncleanly), POST /api/dash/relay/mark_uploaded.
- modules/app_upload.py: list_pending_dashcam_files(), relay lease
  helpers, _upload_dashcam_files() now pauses while a relay lease is
  active.
- modules/app_sql.py: new dashcam_hash_cache table so a file's sha256
  is only computed once (keyed by path+size+mtime) instead of being
  recomputed on every loop iteration/pending-list call - benefits the
  existing background uploader too.
- templates/dash.html / static/js/dash.js: new "Relay via phone" card
  - per-file and "relay all" buttons (manual trigger only, per user
  preference), downloads+uploads one 40MB slice at a time so the
  phone never holds a whole file in memory, retries chunks up to 3x.
- PLAN.md/readme.md/server/README.md updated (Phase 11).

Tested via a full local end-to-end simulation driving the real Pi and
server Flask apps side by side (Postgres mocked only at the db module
boundary - all HTTP/chunking/auth/CORS logic is real): verified Range
downloads (206), byte-for-byte reassembly via SHA256, path-traversal
rejection, and the relay lease correctly pausing/resuming the
background uploader. Not yet tested against a real phone/live network.

templates/dash.html

@@ -97,6 +97,26 @@
                             </p>
                         </div>
                     </div>
+                    <div class="card shadow mt-4">
+                        <div class="card-header py-3">
+                            <p class="text-primary m-0 fw-bold">Relay via phone</p>
+                        </div>
+                        <div class="card-body">
+                            <p class="text-muted small">
+                                Open this page on your phone (while connected to the Pi's
+                                hotspot/WiFi) to download pending dashcam files locally and
+                                upload them straight to the remote server using your phone's own
+                                data connection - useful when the Pi's own WiFi upload is slow.
+                                Starting a relay automatically pauses the Pi's own background
+                                dashcam upload so they don't compete for the same radio.
+                            </p>
+                            <p id="relay-status" class="mb-2">Checking...</p>
+                            <button id="relay-refresh-btn" class="btn btn-secondary btn-sm" type="button">Refresh pending files</button>
+                            <button id="relay-all-btn" class="btn btn-primary btn-sm" type="button" disabled>Relay all pending</button>
+                            <button id="relay-stop-btn" class="btn btn-outline-danger btn-sm" type="button" disabled>Stop relay</button>
+                            <ul id="relay-file-list" class="list-group mt-3"></ul>
+                        </div>
+                    </div>
                 </div>
             </div>
             <footer class="bg-white sticky-footer">