initial web rssh stage 1

docs/REMOTE_ACCESS_IMPL.md

@@ -0,0 +1,47 @@
+# Remote access — implementation notes (v1 WireGuard)
+
+See the full proposal: [20260602_REVERSE_SSH_proposals_summary.md](20260602_REVERSE_SSH_proposals_summary.md).
+
+## Table of contents
+
+<!-- toc -->
+- [App (developer settings)](#app-developer-settings)
+- [BE](#be)
+- [WireGuard third-party](#wireguard-third-party)
+- [Tests](#tests)
+<!-- /toc -->
+
+**Documentation index:** [README.md](README.md)
+
+---
+
+## App (developer settings)
+
+- Dropdown: **Disabled** | **WireGuard** | **RSSH (greyed — not selectable)**
+- Pref key: `dev_remote_access_mode` (`AppPreferences`)
+- **Disabled:** stops `RemoteAccessService`, tears down VPN, POST `type:ra` + `status:disable`
+- **WireGuard:** foreground poll 1–7 min → `RemoteAccessService` → BE `heartbeat.php`
+
+## BE
+
+- Migration: `sql/migrations/007_remote_access.sql`
+- Repository: `src/RemoteAccessRepository.php`
+- Device API: `public/api/heartbeat.php` (`type: ra`)
+- Admin API: `public/api/remote_access.php`
+- UI: `?view=remote_access` (nav + hub card)
+- RBAC: `remote_access_view`, `remote_access_operate`, `remote_access_admin`
+
+## WireGuard third-party
+
+```bash
+bash scripts/init-wireguard-submodule.sh
+```
+
+Optional `:tunnel` module from `third-party/wireguard-android`. Without it, `WireGuardTunnelBridge` uses `RemoteAccessVpnService` (TUN fallback).
+
+## Tests
+
+```bash
+./gradlew :app:testDebugUnitTest
+bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
+```