Continue the Phase 5.1 kids' client (FR-7, FR-14, FR-18).
- Usage Access telemetry: UsageCollector reads the OS per-app foreground
total for the day, TelemetryStore keeps the highest value per (day, app)
across restarts, and TelemetryReporter samples every 60 s and publishes
the list form on restrict/<device>/telemetry. Queued rows republish when
the broker link returns.
- Device-local VpnService: SiteFilterVpnService routes only a fake resolver
into its own tunnel, answers NXDOMAIN for a blocked host while locked,
and forwards everything else upstream through a protected socket. The
allowlist always wins (FR-4). No router, Pi-hole or DNS change.
- MQTT link: caFile support plus the telemetry topic and payload.
- Status screen: Usage Access, telemetry totals and site-filter state.
- Unit tests for host matching, DNS parse/NXDOMAIN and IPv4/UDP round trip.
No Device Owner, no factory reset, no managed profile. The VPN consent
dialog is manual; adb cannot grant it (recorded in android/README.md).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add android/, a normal Gradle/Kotlin project with its own wrapper. It
blocks by interruption: an Accessibility Service watches the foreground
package and a full-screen overlay covers any listed app while the device
is locked (FR-16). No Device Owner, no factory reset, no managed profile.
The client subscribes to the retained restrict/<device>/config topic on
the 8883 TLS plane, keeps the last config on disk so a broker-less device
keeps its rules (FR-14), and reports tampering on its own status topic
(FR-17): a disabled service, a revoked overlay permission, or a
force-stop seen on the next start. The Control Service now parses the
tamper field and raises an Apprise alert, so it reaches Sam.
The block path and the tamper alert are proven on the headless pixel35
emulator on .27; see android/README.md and android/tools/emu-proof.sh.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
