Phase 24: remote trip + dashcam portal

- Add Flask-Login browser session auth (separate from device X-Api-Key auth)
  - modules/user_auth.py: User model, require_login decorator, bcrypt helpers
  - /login with CSRF token, /logout
  - scripts/create_user.py to provision admin user

- Add server-side trip computation from tracking_points
  - db.compute_trips_for_device(): gap > 5 min = new trip, haversine distance,
    upserts into trips table, auto-triggered in bg thread after each upload batch
  - db.list_trips(), db.get_trip_route(): same JSON shape as Pi API
  - db.get_overview_stats(): aggregated totals for overview page
  - db.list_dashcam_files(), db.get_dashcam_file(): browse/stream helpers

- Add web portal to server/app.py
  - Overview page (/): stat cards + recent trips + recent clips
  - Trip history (/history): reuses Pi history.js + data-list.js unchanged
    via /api/trips + /api/trip/<id> compatibility aliases
  - Dashcam archive (/dashcam): file list + inline video player
  - /api/v1/portal/dashcam/stream/<id>: Range-request streaming, path traversal guard
  - /api/geocode: same Nominatim→reverse_geocoder offline fallback as Pi

- Add server templates (server/templates/)
  - base.html: shared shell with 'Remote server' badge in sidebar + mobile topbar
  - login.html, index.html, history.html, dashcam.html, components.html

- DB schema: users + trips tables added to init.sql (fresh deploys) +
  migrate_phase24.sql (existing deployments)

- Infrastructure: Dockerfile uses repo-root build context to copy shared
  static/ assets; docker-compose updated; SECRET_KEY + DEVICE_NAME in .env;
  requirements: Flask-Login, bcrypt, reverse_geocoder

Co-authored-by: Copilot <[email protected]>

server/templates/history.html

@@ -0,0 +1,81 @@
+{% extends "base.html" %}
+{% from "components.html" import data_table %}
+
+{% block title %}Trip history – Yaris OBD Remote{% endblock %}
+
+{% block styles %}
+<link rel="stylesheet" href="{{ url_for('static', filename='vendor/leaflet/leaflet.css') }}">
+{% endblock %}
+
+{% block content %}
+<h3 class="text-dark mb-3 fw-bold">Trip history</h3>
+
+<div class="row g-3">
+    {# ── Trip list ──────────────────────────────────────────────────── #}
+    <div class="col-12 col-xl-5">
+        <div class="card shadow-sm">
+            <div class="card-header py-2">
+                <h6 class="text-primary fw-bold m-0">Recorded trips</h6>
+            </div>
+            <div class="card-body p-0">
+                <div id="trip-loading" class="text-center text-muted py-4">
+                    <span class="spinner-border spinner-border-sm me-2" aria-hidden="true"></span>
+                    Loading…
+                </div>
+                <div id="trip-error" class="alert alert-danger m-3" role="alert" hidden></div>
+                {{ data_table(
+                    "trip-list",
+                    [
+                        {"key": "started", "label": "Started", "sortable": true},
+                        {"key": "distance", "label": "km", "sortable": true},
+                        {"key": "duration", "label": "Time", "sortable": true},
+                        {"key": "maxSpeed", "label": "Max", "sortable": true},
+                        {"key": "odometer", "label": "Odometer", "sortable": false},
+                        {"key": "action", "label": "", "sortable": false, "class": "d-none d-sm-table-cell"}
+                    ],
+                    "No trips detected",
+                    "Trips appear once the Pi has uploaded tracking data."
+                ) }}
+            </div>
+        </div>
+    </div>
+
+    {# ── Route replay map ───────────────────────────────────────────── #}
+    <div class="col-12 col-xl-7">
+        <div class="card shadow-sm">
+            <div class="card-header py-2 d-flex justify-content-between align-items-center">
+                <h6 class="text-primary fw-bold m-0">Route replay</h6>
+                <div class="d-flex align-items-center gap-2">
+                    <button id="btn-recenter-history" class="btn btn-outline-secondary btn-sm" type="button" title="Recenter map" hidden>
+                        <i class="fas fa-crosshairs" aria-hidden="true"></i>
+                    </button>
+                    <span id="trip-summary" class="small text-muted">Select a trip</span>
+                </div>
+            </div>
+            <div class="card-body p-0">
+                <div id="history-map" aria-label="Selected trip route map"></div>
+                <div id="trip-timeline" class="border-top p-3" hidden>
+                    <div class="d-flex align-items-center gap-3">
+                        <button id="trip-play" class="btn btn-primary btn-sm" type="button" aria-label="Play">
+                            <i class="fas fa-play" aria-hidden="true"></i>
+                        </button>
+                        <input id="trip-scrubber" class="form-range flex-grow-1" type="range"
+                               min="0" max="0" value="0" aria-label="Trip replay timeline">
+                    </div>
+                    <div class="d-flex flex-wrap justify-content-between gap-2 small mt-2">
+                        <strong id="trip-replay-time"></strong>
+                        <span id="trip-replay-speed" class="text-muted"></span>
+                    </div>
+                    <div id="trip-replay-location" class="text-muted mt-1" style="font-size:0.75rem;min-height:1rem"></div>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}
+
+{% block scripts %}
+<script src="{{ url_for('static', filename='vendor/leaflet/leaflet.js') }}"></script>
+<script src="{{ url_for('static', filename='js/data-list.js') }}"></script>
+<script src="{{ url_for('static', filename='js/history.js') }}"></script>
+{% endblock %}