v1.1.0

A passcode for the phone web dashboard, and much smaller downloads.

• WEB UI passcode (desktop and Android, identical). With ALLOW REMOTE (WEB UI) on, every page, route and the live /ws feed now needs a code; this PC / phone itself (127.0.0.1, ::1) never does, and local-only mode is unchanged. Each time WEB UI is turned on TRACE makes a fresh 6-digit code and a separate one-time QR login token, kept in memory only (never in settings.json or a log). Other devices see a small login page in TRACE's style with a code box and a Remember this device tick. Codes are compared in constant time; 5 wrong tries lock that device's IP out for 60 s, doubling each time up to 10 minutes, with the same message for a wrong code and a lockout. The Dashboard shows WEB UI CODE in large text, a QR (SCAN TO OPEN) for http://<ip>:8080/?t=<token> and a LOG OUT ALL DEVICES button next to the address, hidden while WEB UI or ALLOW REMOTE is off. The QR token works once or for 5 minutes, then the QR refreshes by itself; opening it sets the login cookie and redirects to the same address without the token. Login cookies are HttpOnly, SameSite=Strict and end with the browser session; Remember this device adds a 30-day cookie, stored only as a SHA-256 hash with its date in devices.json next to settings.json, so a remembered phone skips the code even after it changes. Turning WEB UI off logs every device out of that session; LOG OUT ALL DEVICES also forgets remembered devices and closes open live views. Every response now sends X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer and Cache-Control: no-store. New modules webui_auth.py, webui_login.py and qr.py (a small built-in QR encoder, no new dependency); on Android WebAuth.kt and QrCode.kt (no ZXing needed), checked against the desktop by unit tests and test_android_parity.py.
• Smaller downloads. TRACE.exe goes from 52.6 MB to 40.1 MB (the Windows zip from 52.0 MB to 39.8 MB) and the Android APK from 6.8 MB to 1.7 MB, with the features unchanged. Windows is now built from packaging/TRACE-windows.spec, which leaves out what TRACE never uses (checked against the code): other GUI toolkits and matplotlib backends, test suites and dev tools, numpy/pandas extras, SQLite, named-timezone data, Pillow's AVIF/WebP/colour-management codecs, unused pycryptodome parts, matplotlib's sample data, PDF/PS and maths fonts, and Tcl/Tk time-zone, translation and demo files. It also strips docstrings (optimize=2; the test suite passes under python -OO). Still a single TRACE.exe at the top of the zip (the MSIX build packs it as-is), every TRACE font is kept, and no exe packer is used (upx=False). Android release builds now use R8 and resource shrinking (app/proguard-rules.pro; the workflow also keeps the R8 mapping file for crash traces), and the launcher icons are lossless WebP (msix/make_assets.py reads the WebP and makes identical Store tiles). Still one universal APK with the same signing.
• Desktop: a Microsoft Store (MSIX) install is now detected (updates.is_store_install()). There the Launcher never contacts GitHub, shows just the version in green (no update text or release link) and hides the Ignore update checks / CHECK FOR UPDATES boxes, because the Store handles updates. Direct .exe, PyPI and Android behave as before.
• Android: the Dyno & Tune Lap Analyst tab is now in the app too (power and torque curve, per-gear thrust and shift points, gearbox table, tuning hints, Lap B overlay, per-car weight prompt), so the app has all 20 lap chart groups like the desktop.