Add cellular data toggle, Tailscale remote access, fix ToggleRow padding

- ToggleRow: fix cramped layout — proper horizontal + vertical card padding
- ConnectionStore: add allowCellularBackup, useTailscaleWhenRemote, tailscaleHost
- LANMonitor: add isOnCellular (NWPath cellular interface), isTailscaleActive
  (detects utun interface with 100.x.x.x CGNAT address), openTailscaleApp()
- BackupEngine: gate backup on cellular setting; resolveHost() switches to
  tailscaleHost when not on trusted LAN and Tailscale tunnel is active
- SettingsView: CONNECTIVITY section (cellular toggle + live status),
  REMOTE ACCESS section (Tailscale toggle, host field, status dot, Open button)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Services/BackupEngine.swift

@@ -20,6 +20,16 @@ final class BackupEngine: ObservableObject {
     ) async throws -> BackupResult {
         isCancelled = false
         let startDate = Date()
+        let store = ConnectionStore.shared
+        let lan = LANMonitor.shared
+
+        // Gate: block cellular unless user opted in (never block on LAN trigger)
+        if !triggeredByLAN && lan.isOnCellular && !store.allowCellularBackup {
+            throw BackupError.networkUnavailable
+        }
+
+        // Resolve effective host: use Tailscale when remote and tunnel is active
+        let host = resolveHost(connection: connection, store: store, lan: lan)
 
         // 1. Fetch assets
         job.prepare()
@@ -33,7 +43,7 @@ final class BackupEngine: ObservableObject {
         }
 
         try await transfer.connect(
-            to: connection.host,
+            to: host,
             port: connection.port,
             username: connection.username,
             password: connection.password
@@ -63,7 +73,6 @@ final class BackupEngine: ObservableObject {
 
             let remotePath = "\(connection.remotePath)/\(asset.filename)"
 
-            // Skip if exists (newFilesOnly = true in filter)
             if filter.newFilesOnly, (try? await transfer.fileExists(at: remotePath)) == true {
                 job.fileCompleted(skipped: true)
                 skipped += 1
@@ -74,7 +83,8 @@ final class BackupEngine: ObservableObject {
                 let localURL = try await photoService.exportAsset(asset)
                 defer { try? FileManager.default.removeItem(at: localURL) }
 
-                let fileSize = (try? localURL.resourceValues(forKeys: [.fileSizeKey]).fileSize).flatMap { Int64($0) } ?? 0
+                let fileSize = (try? localURL.resourceValues(forKeys: [.fileSizeKey]).fileSize)
+                    .flatMap { Int64($0) } ?? 0
 
                 try await transfer.upload(localURL: localURL, remotePath: remotePath) { sent, total in
                     let speed = speedTracker.update(bytesSent: sent)
@@ -109,22 +119,33 @@ final class BackupEngine: ObservableObject {
 
         job.finish(result: result)
 
-        // 5. Persist history
-        let entry = BackupHistoryEntry(result: result, nasHost: connection.host, triggeredByLAN: triggeredByLAN)
-        ConnectionStore.shared.appendHistoryEntry(entry)
+        let entry = BackupHistoryEntry(result: result, nasHost: host, triggeredByLAN: triggeredByLAN)
+        store.appendHistoryEntry(entry)
 
-        // 6. Push notification
         await sendCompletionNotification(result: result)
 
         return result
     }
 
+    // Returns the Tailscale host when outside the trusted network and tunnel is up,
+    // otherwise falls back to the saved local host.
+    private func resolveHost(connection: NASConnection, store: ConnectionStore, lan: LANMonitor) -> String {
+        let onTrustedLAN = store.trustedSSIDs.contains(lan.currentSSID ?? "")
+        guard !onTrustedLAN,
+              store.useTailscaleWhenRemote,
+              !store.tailscaleHost.isEmpty,
+              lan.isTailscaleActive else {
+            return connection.host
+        }
+        return store.tailscaleHost
+    }
+
     func cancel() {
         isCancelled = true
         job.cancel()
     }
 
-    func pause() { job.pause() }
+    func pause()  { job.pause() }
     func resume() { job.resume() }
 
     private func sendCompletionNotification(result: BackupResult) async {

Services/LANMonitor.swift

@@ -1,6 +1,8 @@
 import Foundation
 import Network
 import NetworkExtension
+import Darwin
+import UIKit
 import Combine
 
 @MainActor
@@ -9,6 +11,8 @@ final class LANMonitor: ObservableObject {
 
     @Published private(set) var isOnNetwork: Bool = false
     @Published private(set) var currentSSID: String? = nil
+    @Published private(set) var isOnCellular: Bool = false
+    @Published private(set) var isTailscaleActive: Bool = false
 
     private let monitor = NWPathMonitor()
     private let queue = DispatchQueue(label: "com.albert.nasbackup.lan", qos: .utility)
@@ -21,10 +25,11 @@ final class LANMonitor: ObservableObject {
         monitor.pathUpdateHandler = { [weak self] path in
             guard let self else { return }
             Task { @MainActor in
-                let satisfied = path.status == .satisfied
-                self.isOnNetwork = satisfied
+                self.isOnNetwork   = path.status == .satisfied
+                self.isOnCellular  = path.usesInterfaceType(.cellular)
+                self.isTailscaleActive = self.detectTailscale()
 
-                if satisfied {
+                if path.status == .satisfied {
                     await self.checkSSID()
                 } else {
                     self.currentSSID = nil
@@ -34,13 +39,36 @@ final class LANMonitor: ObservableObject {
         monitor.start(queue: queue)
     }
 
-    func stop() {
-        monitor.cancel()
+    func stop() { monitor.cancel() }
+
+    // Detect Tailscale: look for a utun interface with an IP in the 100.64.0.0/10 CGNAT range
+    private func detectTailscale() -> Bool {
+        var ifaddr: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&ifaddr) == 0 else { return false }
+        defer { freeifaddrs(ifaddr) }
+        var ptr = ifaddr
+        while let current = ptr {
+            defer { ptr = current.pointee.ifa_next }
+            let name = String(cString: current.pointee.ifa_name)
+            guard name.hasPrefix("utun"),
+                  let addr = current.pointee.ifa_addr,
+                  addr.pointee.sa_family == UInt8(AF_INET) else { continue }
+            var sa = addr.pointee
+            var buf = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            getnameinfo(&sa, socklen_t(sa.sa_len), &buf, socklen_t(buf.count), nil, 0, NI_NUMERICHOST)
+            if String(cString: buf).hasPrefix("100.") { return true }
+        }
+        return false
+    }
+
+    // Open the Tailscale app so the user can connect the VPN
+    func openTailscaleApp() {
+        guard let url = URL(string: "tailscale://") else { return }
+        UIApplication.shared.open(url)
     }
 
     private func checkSSID() async {
-        let ssid = await fetchCurrentSSID()
-        self.currentSSID = ssid
+        currentSSID = await fetchCurrentSSID()
     }
 
     func fetchCurrentSSID() async -> String? {