Add cellular data toggle, Tailscale remote access, fix ToggleRow padding

- ToggleRow: fix cramped layout — proper horizontal + vertical card padding
- ConnectionStore: add allowCellularBackup, useTailscaleWhenRemote, tailscaleHost
- LANMonitor: add isOnCellular (NWPath cellular interface), isTailscaleActive
  (detects utun interface with 100.x.x.x CGNAT address), openTailscaleApp()
- BackupEngine: gate backup on cellular setting; resolveHost() switches to
  tailscaleHost when not on trusted LAN and Tailscale tunnel is active
- SettingsView: CONNECTIVITY section (cellular toggle + live status),
  REMOTE ACCESS section (Tailscale toggle, host field, status dot, Open button)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Services/LANMonitor.swift

@@ -1,6 +1,8 @@
 import Foundation
 import Network
 import NetworkExtension
+import Darwin
+import UIKit
 import Combine
 
 @MainActor
@@ -9,6 +11,8 @@ final class LANMonitor: ObservableObject {
 
     @Published private(set) var isOnNetwork: Bool = false
     @Published private(set) var currentSSID: String? = nil
+    @Published private(set) var isOnCellular: Bool = false
+    @Published private(set) var isTailscaleActive: Bool = false
 
     private let monitor = NWPathMonitor()
     private let queue = DispatchQueue(label: "com.albert.nasbackup.lan", qos: .utility)
@@ -21,10 +25,11 @@ final class LANMonitor: ObservableObject {
         monitor.pathUpdateHandler = { [weak self] path in
             guard let self else { return }
             Task { @MainActor in
-                let satisfied = path.status == .satisfied
-                self.isOnNetwork = satisfied
+                self.isOnNetwork   = path.status == .satisfied
+                self.isOnCellular  = path.usesInterfaceType(.cellular)
+                self.isTailscaleActive = self.detectTailscale()
 
-                if satisfied {
+                if path.status == .satisfied {
                     await self.checkSSID()
                 } else {
                     self.currentSSID = nil
@@ -34,13 +39,36 @@ final class LANMonitor: ObservableObject {
         monitor.start(queue: queue)
     }
 
-    func stop() {
-        monitor.cancel()
+    func stop() { monitor.cancel() }
+
+    // Detect Tailscale: look for a utun interface with an IP in the 100.64.0.0/10 CGNAT range
+    private func detectTailscale() -> Bool {
+        var ifaddr: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&ifaddr) == 0 else { return false }
+        defer { freeifaddrs(ifaddr) }
+        var ptr = ifaddr
+        while let current = ptr {
+            defer { ptr = current.pointee.ifa_next }
+            let name = String(cString: current.pointee.ifa_name)
+            guard name.hasPrefix("utun"),
+                  let addr = current.pointee.ifa_addr,
+                  addr.pointee.sa_family == UInt8(AF_INET) else { continue }
+            var sa = addr.pointee
+            var buf = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            getnameinfo(&sa, socklen_t(sa.sa_len), &buf, socklen_t(buf.count), nil, 0, NI_NUMERICHOST)
+            if String(cString: buf).hasPrefix("100.") { return true }
+        }
+        return false
+    }
+
+    // Open the Tailscale app so the user can connect the VPN
+    func openTailscaleApp() {
+        guard let url = URL(string: "tailscale://") else { return }
+        UIApplication.shared.open(url)
     }
 
     private func checkSSID() async {
-        let ssid = await fetchCurrentSSID()
-        self.currentSSID = ssid
+        currentSSID = await fetchCurrentSSID()
     }
 
     func fetchCurrentSSID() async -> String? {