Add read-only MG4 ADB status collector

README.md

@@ -12,6 +12,7 @@ The current MVP slice includes:
 - field-level unavailable states when host data cannot be collected;
 - authenticated Server-Sent Events for live status updates;
 - allowlisted refresh-health, offline network-diagnostics, and sanitized support-bundle jobs;
+- disabled-by-default, serial-pinned ADB status with read-only head-unit identity and display collection;
 - a responsive 1920×720-oriented setup, login, and dashboard UI;
 - an idempotent Raspberry Pi installer with systemd start-on-boot support;
 - atomic, dashboard-triggered Git updates with automatic verification and rollback safety;
@@ -149,6 +150,36 @@ Important values:
 - `ALLOWED_ORIGINS`: comma-separated exact browser origins accepted for state changes
 - `UPDATE_STATUS_PATH`: update state shared with the systemd update unit
 - `VERSION_FILE`: revision metadata for the active atomic release
+- `ADB_ENABLED`: enables the read-only head-unit collector; defaults to `false`
+- `ADB_SERIAL`: exact device serial used for every ADB command when enabled
+- `ADB_PATH` and `ADB_TIMEOUT_MS`: executable path and per-command timeout
+
+### Read-only ADB setup
+
+ADB integration is optional and disabled by default. Every command is pinned to one
+configured serial, uses a fixed server-side argument list, and has a timeout and 16 KiB
+output limit. It currently reads connection state, selected `getprop` identity fields,
+and `wm size`/`wm density` only.
+
+On a deployed Pi, rerun `install.sh` once so `android-tools-adb` is present and the
+service account receives the standard `plugdev` device-access group. Connect the head
+unit, then establish authorization as the service account:
+
+```bash
+sudo -u pi-companion -H adb devices
+```
+
+Accept the authorization prompt on the parked infotainment screen. Set these values in
+`/etc/pi-car-companion/companion.env` and restart the service:
+
+```text
+ADB_ENABLED=true
+ADB_SERIAL=<exact serial shown by adb devices>
+```
+
+If the device is disconnected, offline, unauthorized, partially readable, or ADB is
+missing, the dashboard reports that state without substituting generated data. Do not
+add shell strings or state-changing commands to this collector.
 
 ## Safety boundary