feat: APK distribution pipeline — server hosting + Pi auto-update + /app routes

PLAN.md

@@ -2229,13 +2229,16 @@ The app reuses the existing Pi REST API surface with no changes:
   dark top bar.
 - Follow-up polish deferred: card shadows, blue `btn-primary` buttons, page titles.
 
-**28.8 — Polish + distribution 🚧 IN PROGRESS (2026-08-15)**
-- ✅ App icon (adaptive, red bg + white gauge), native splash screen (API 31+), "Yaris OBD"
+**28.8 — Polish + distribution ✅ DONE (2026-08-15)**
+- ✅ App icon (adaptive, red bg + white gauge), native splash (API 31+), "yaris-obd"
   label, OS-following dark mode.
-- ✅ Release build: local signing keystore (gitignored), R8-verified — `app-release.apk`
-  (~43 MB) installs and launches on the Pixel.
-- ⬜ Distribution: host the APK on the Pi (`GET /app` → `static/app/` + download page).
-  Play Store out of scope.
+- ✅ Release build: local signing keystore (gitignored), R8-verified signed APK (~43 MB).
+- ✅ Distribution pipeline (server → Pi → phone): the server publishes the APK
+  (`/api/v1/app/latest` + `/app/yaris-obd.apk` + a portal upload page), the Pi mirrors it
+  on a systemd timer (`deploy/yaris_app_updater.py` + `yaris-app-updater.{service,timer}`),
+  and the phone installs from `http://10.42.0.1/app`.
+- Deployment: run `install_app_updater.sh` on the Pi; publish a build via the portal upload
+  page (or drop the APK in the server's mounted `dashcam/app/` volume). Play Store out of scope.
 
 #### Open questions (resolve during 28.1)