feat: back up the phone's photos to a group, once a day on Wi-FiHEADmain

The Android application sends the photos taken on the phone to one folder of
one group chosen by the member (docs/MESHBAY_DESIGN.md §9.12). The phone lists
MediaStore, keeps a ledger of what was sent and hands each photo's bytes to the
page by an opaque token on the packaged origin; the page decides when a run is
due and uploads through the existing path, one photo at a time under a slot.

- Once a day from the last finished run, on an unmetered network only;
  "Back up now" asks first on mobile data. Leaving Wi-Fi stops after the file
  in flight.
- Photos already on the phone are sent by default, newest first, under
  <folder>/YYYY/MM; edits are sent beside the original as -edited-<date>.
- Additive by construction: nothing is ever deleted, renamed or replaced on
  the node, and a photo deleted on the node is not sent again.
- A confirmation names the group, owner, members, folder and size when the
  destination or starting point changes; a lasting refusal (disk full, folder
  read-only or gone, no longer a member) is said once and retried a day later.
- No ACCESS_MEDIA_LOCATION, so the platform redacts photo locations.
- A dataSync foreground service keeps a run going with the screen off.

HEIC/HEIF photos are sent but not shown in Photos yet (§15.2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/packages/meshbay-android/README.md b/packages/meshbay-android/README.md
index 69977ec..adb7e66 100644
--- a/packages/meshbay-android/README.md
+++ b/packages/meshbay-android/README.md
@@ -62,6 +62,14 @@ connector could decrypt, and the fetch slows to a four-hour net. The page turns
 it on in Settings and registers the phone with the hub; muting and "disable
 all" are decided on the hub, which then creates nothing (§11.3).
 
+Photo backup (`photos/`, §9.12): MediaStore is listed natively, a ledger of
+what was sent is kept per account, group and folder, and each photo's bytes are
+handed to the page at `/photosync/<token>` on the packaged origin — never a
+URI. The page decides when a run is due and sends; a `dataSync` foreground
+service (`BackupService`) keeps it going with the screen off. No
+`ACCESS_MEDIA_LOCATION`, so the platform redacts a photo's location from what
+is read.
+
 Not built yet: phone-specific behaviour (back button, network handover,
 keeping a download alive with the screen off), updates through a store.