Add live hotspot network diagnostics

README.md

@@ -17,6 +17,7 @@ The current MVP slice includes:
 - an idempotent Raspberry Pi installer with systemd start-on-boot support;
 - atomic, dashboard-triggered Git updates with automatic verification and rollback safety;
 - optional dual-radio Wi-Fi failover with an always-recoverable offline car hotspot;
+- authenticated live network diagnostics for hotspot clients, DNS query metadata, and active destination flows;
 - automated API security tests and reproducible quality commands.
 
 The ADB transport, job UI, artifacts, Android companion, and remaining operations work are tracked in [PLAN.md](./PLAN.md).
@@ -157,6 +158,7 @@ Important values:
 - `NETWORK_MANAGER_ENABLED`: enables the separately supervised NetworkManager controller after explicit setup
 - `NETWORK_STATUS_PATH` and `NETWORK_COMMAND_PATH`: validated state and fixed-action request files
 - `NETWORK_CONFIGURATION_REQUEST_PATH`: mode-0600 one-time hotspot configuration request consumed by the root service
+- `NETWORK_ACTIVITY_PATH`: bounded observer snapshot consumed by the authenticated dashboard
 - `NETWORK_HOTSPOT_INTERFACE` / `NETWORK_UPSTREAM_INTERFACE`: default to built-in `wlan0` and USB `wlan1`
 - `NETWORK_PROBE_TIMEOUT_SECONDS`: maximum built-in upstream attempt before restoring the offline hotspot
 
@@ -187,7 +189,17 @@ Behavior by mode:
 - no upstream after 60 seconds: `wlan0` returns to the offline hotspot automatically.
 - `wlan1` returns: it must connect and remain stable before `wlan0` returns to hotspot mode.
 
-Add phone hotspots as additional saved `wlan1` profiles. Dashboard actions only select existing NetworkManager profiles; Wi-Fi credentials are not accepted through the API.
+Add phone hotspots as additional saved `wlan1` profiles. Upstream actions only select existing NetworkManager profiles; the dashboard credential form configures the isolated car hotspot, not arbitrary upstream networks.
+
+### Network activity diagnostics
+
+The authenticated **Network** page refreshes every two seconds and reports:
+
+- current and recently leased hotspot clients from NetworkManager DHCP leases and the neighbor table;
+- up to 250 DNS query names/types from the previous 15 minutes;
+- up to 150 active TCP/UDP destination IP, port, state, packet, and byte counters from conntrack.
+
+The observer runs read-only as a separate root service and publishes a validated snapshot to the unprivileged application. It does not capture packet payloads, passwords, cookies, HTTP bodies, or HTTPS paths. DNS metadata comes from the system journal and follows its configured retention; the dashboard snapshot is overwritten rather than appended.
 
 ### Read-only ADB setup