feat: add Bluetooth Android companion

server/tests/app.test.ts

@@ -341,6 +341,66 @@ describe("authentication boundary", () => {
     expect(removed.statusCode).toBe(204);
   });
 
+  it("pairs, updates, and revokes a Bluetooth mobile companion", async () => {
+    const app = await createApp();
+    const csrfToken = await csrf(app);
+    await setup(app, csrfToken);
+    const login = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      headers: mutationHeaders(csrfToken),
+      payload: { username: "owner", password: "Correct-horse1" }
+    });
+    const session = login.cookies.find((item) => item.name === SESSION_COOKIE)?.value ?? "";
+    const cookie = `${CSRF_COOKIE}=${csrfToken}; ${SESSION_COOKIE}=${session}`;
+    const webHeaders = { ...mutationHeaders(csrfToken), cookie };
+
+    expect((await app.inject({ method: "GET", url: "/api/mobile/devices" })).statusCode).toBe(401);
+    const pairing = await app.inject({ method: "POST", url: "/api/mobile/pairing", headers: webHeaders });
+    expect(pairing.statusCode).toBe(200);
+    const code = pairing.json<{ code: string }>().code;
+    expect(code).toMatch(/^\d{6}$/);
+
+    const deviceId = "2f9ca5d6-28cd-45a7-a7f5-27a13dc9eb98";
+    const paired = await app.inject({
+      method: "POST",
+      url: "/internal/mobile/pair",
+      payload: { code, deviceId, deviceName: "Owner phone" }
+    });
+    expect(paired.statusCode).toBe(200);
+    const mobileToken = paired.json<{ token: string }>().token;
+    const mobileHeaders = { "x-mobile-token": mobileToken };
+
+    const location = await app.inject({
+      method: "POST",
+      url: "/internal/mobile/location",
+      headers: mobileHeaders,
+      payload: {
+        capturedAt: "2026-07-31T20:00:00.000Z",
+        latitude: 55.6761,
+        longitude: 12.5683,
+        accuracyMeters: 4.2,
+        speedKph: 42.5,
+        batteryPercent: 76,
+        networkType: "cellular"
+      }
+    });
+    expect(location.statusCode).toBe(200);
+
+    const snapshot = await app.inject({ method: "GET", url: "/internal/mobile/snapshot", headers: mobileHeaders });
+    expect(snapshot.statusCode).toBe(200);
+    expect(snapshot.json()).toMatchObject({
+      protocolVersion: 1,
+      phone: { latitude: 55.6761, speedKph: 42.5, networkType: "cellular" },
+      shortcuts: []
+    });
+
+    const devices = await app.inject({ method: "GET", url: "/api/mobile/devices", headers: { cookie } });
+    expect(devices.json()).toMatchObject({ devices: [{ id: deviceId, name: "Owner phone", revokedAt: null }] });
+    expect((await app.inject({ method: "DELETE", url: `/api/mobile/devices/${deviceId}`, headers: webHeaders })).statusCode).toBe(204);
+    expect((await app.inject({ method: "GET", url: "/internal/mobile/snapshot", headers: mobileHeaders })).statusCode).toBe(401);
+  });
+
   it("exposes only allowlisted jobs and authenticated run history", async () => {
     const app = await createApp();
     const token = await csrf(app);