feat: back up the phone's photos to a group, once a day on Wi-Fi

The Android application sends the photos taken on the phone to one folder of
one group chosen by the member (docs/MESHBAY_DESIGN.md §9.12). The phone lists
MediaStore, keeps a ledger of what was sent and hands each photo's bytes to the
page by an opaque token on the packaged origin; the page decides when a run is
due and uploads through the existing path, one photo at a time under a slot.

- Once a day from the last finished run, on an unmetered network only;
  "Back up now" asks first on mobile data. Leaving Wi-Fi stops after the file
  in flight.
- Photos already on the phone are sent by default, newest first, under
  <folder>/YYYY/MM; edits are sent beside the original as -edited-<date>.
- Additive by construction: nothing is ever deleted, renamed or replaced on
  the node, and a photo deleted on the node is not sent again.
- A confirmation names the group, owner, members, folder and size when the
  destination or starting point changes; a lasting refusal (disk full, folder
  read-only or gone, no longer a member) is said once and retried a day later.
- No ACCESS_MEDIA_LOCATION, so the platform redacts photo locations.
- A dataSync foreground service keeps a run going with the screen off.

HEIC/HEIF photos are sent but not shown in Photos yet (§15.2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 37 insertions, 0 deletions

diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 7afb77b..74dae15 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -378,6 +378,37 @@ coordinates are still inside the photo itself, as your phone wrote them, so
 anyone who downloads the original file has them. Strip them before sharing if
 that matters to you.
 
+### Backing up your phone's photos
+
+On the Android application, **Settings → Photo backup** sends the photos taken
+on your phone to a folder of one of your groups, once a day.
+
+- **Set up** asks for access to your photos, then for a group, a folder and the
+  albums to send. Only folders you may add to and that the group's Photos tab
+  shows are offered. The camera is ticked; screenshots and other albums are
+  yours to add.
+- By default **the photos already on the phone are sent too**, newest first,
+  then each new one. Choose "Only photos taken from now on" to skip the ones
+  already there.
+- Before anything is sent you are told where the photos go, how many members
+  the group has and how much will be sent. **Everyone in that group will be
+  able to see and download them.** You can delete what you sent afterwards,
+  but not the copies others have already downloaded — so pick the group with
+  care. Changing the group or the folder later asks again.
+- It runs **on Wi-Fi only** (more exactly, on a connection that is not charged
+  by the amount), once a day, while the application is open — with the screen
+  off too. If the application was not opened all day, it runs the next time it
+  is. **Back up now** runs at once; on mobile data it tells you how much it is
+  about to send and asks first.
+- Photos go into folders by year and month (`2026/10`). **A photo you delete
+  from the phone stays in the group**, and one deleted from the group is not
+  sent again. A photo you edit on the phone is sent again beside the original,
+  with `-edited-` and the date in its name.
+- **Where a photo was taken is removed** from the copy that is sent.
+- If the backup cannot go on — the node's disk is full, the folder no longer
+  accepts files, you left the group — it stops, says why once in a
+  notification and in Settings, and tries again the next day.
+
 ### Search
 
 The magnifying glass in the sidebar searches **across every group you are in**
@@ -1030,6 +1061,12 @@ Better to know now than to go looking for it:
   with the screen off, from one track to the next, with a notification shown
   while it plays. A phone browser works too.
 - **A node cannot be hosted on Android**, and is not planned to be.
+- **Photo backup only runs while the application is open** (the screen may be
+  off). There is no button yet to remove everything the phone sent to a group
+  in one go — delete those files from the group instead.
+- **Photos in the HEIC format are backed up but do not show in Photos** yet:
+  they are in the folder (Files lists them) and can be downloaded. Most Android
+  phones take JPEG unless set otherwise.
 - **Hubs do not talk to each other yet.** Everyone in a group needs an account
   on the same hub.
 - **Casting reaches Chromecast devices** from the desktop and Android