Add cellular data toggle, Tailscale remote access, fix ToggleRow padding

- ToggleRow: fix cramped layout — proper horizontal + vertical card padding
- ConnectionStore: add allowCellularBackup, useTailscaleWhenRemote, tailscaleHost
- LANMonitor: add isOnCellular (NWPath cellular interface), isTailscaleActive
  (detects utun interface with 100.x.x.x CGNAT address), openTailscaleApp()
- BackupEngine: gate backup on cellular setting; resolveHost() switches to
  tailscaleHost when not on trusted LAN and Tailscale tunnel is active
- SettingsView: CONNECTIVITY section (cellular toggle + live status),
  REMOTE ACCESS section (Tailscale toggle, host field, status dot, Open button)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Features/Settings/SettingsView.swift

@@ -2,6 +2,7 @@ import SwiftUI
 
 struct SettingsView: View {
     @EnvironmentObject var store: ConnectionStore
+    @EnvironmentObject var lanMonitor: LANMonitor
 
     var body: some View {
         ZStack {
@@ -12,6 +13,8 @@ struct SettingsView: View {
                     LANTriggerSection()
                     mediaSection
                     quietHoursSection
+                    connectivitySection
+                    remoteAccessSection
                     notificationSection
                 }
                 .padding(.horizontal, AppTheme.hPad)
@@ -100,6 +103,123 @@ struct SettingsView: View {
         .padding(.vertical, 12)
     }
 
+    // MARK: — Connectivity
+
+    private var connectivitySection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            sectionLabel("CONNECTIVITY")
+
+            VStack(spacing: 0) {
+                ToggleRow(
+                    icon: "antenna.radiowaves.left.and.right",
+                    title: "Allow over cellular",
+                    subtitle: "Uses mobile data when Wi-Fi is unavailable",
+                    isOn: $store.allowCellularBackup
+                )
+
+                // Live status chip
+                if lanMonitor.isOnCellular {
+                    hairline
+                    HStack(spacing: 8) {
+                        Circle()
+                            .fill(store.allowCellularBackup ? AppTheme.positive : AppTheme.destructive)
+                            .frame(width: 6, height: 6)
+                        Text(store.allowCellularBackup
+                             ? "On cellular — backup allowed"
+                             : "On cellular — backup blocked")
+                        .font(AppTheme.micro(11))
+                        .foregroundStyle(store.allowCellularBackup
+                                         ? AppTheme.positive : AppTheme.destructive)
+                    }
+                    .padding(.horizontal, AppTheme.cardPad)
+                    .padding(.vertical, 10)
+                }
+            }
+            .background(Color.white)
+            .clipShape(RoundedRectangle(cornerRadius: AppTheme.radius, style: .continuous))
+            .shadow(color: AppTheme.cardShadow, radius: 12, x: 0, y: 2)
+            .animation(.spring(response: 0.3, dampingFraction: 0.8), value: lanMonitor.isOnCellular)
+        }
+    }
+
+    // MARK: — Remote Access (Tailscale)
+
+    private var remoteAccessSection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            sectionLabel("REMOTE ACCESS")
+
+            VStack(spacing: 0) {
+                ToggleRow(
+                    icon: "network.badge.shield.half.filled",
+                    title: "Use Tailscale when remote",
+                    subtitle: "Connects via VPN when not on home network",
+                    isOn: $store.useTailscaleWhenRemote
+                )
+
+                if store.useTailscaleWhenRemote {
+                    hairline
+
+                    // Tailscale host input
+                    HStack(spacing: 12) {
+                        Image(systemName: "server.rack")
+                            .font(.system(size: 14, weight: .regular))
+                            .foregroundStyle(AppTheme.inkSecondary)
+                            .frame(width: 20)
+                        VStack(alignment: .leading, spacing: 3) {
+                            Text("Tailscale NAS host")
+                                .font(AppTheme.micro())
+                                .foregroundStyle(AppTheme.inkTertiary)
+                            TextField("100.x.x.x  or  nas.tail-xxxxx.ts.net",
+                                      text: $store.tailscaleHost)
+                                .font(AppTheme.body())
+                                .foregroundStyle(AppTheme.ink)
+                                .keyboardType(.URL)
+                                .autocorrectionDisabled()
+                                .textInputAutocapitalization(.never)
+                        }
+                    }
+                    .padding(.horizontal, AppTheme.cardPad)
+                    .padding(.vertical, 12)
+
+                    hairline
+
+                    // Tailscale status + open button
+                    HStack(spacing: 10) {
+                        Circle()
+                            .fill(lanMonitor.isTailscaleActive ? AppTheme.positive : AppTheme.inkQuaternary)
+                            .frame(width: 7, height: 7)
+                        Text(lanMonitor.isTailscaleActive ? "Tailscale connected" : "Tailscale not active")
+                            .font(AppTheme.caption())
+                            .foregroundStyle(lanMonitor.isTailscaleActive
+                                             ? AppTheme.positive : AppTheme.inkTertiary)
+                        Spacer()
+                        if !lanMonitor.isTailscaleActive {
+                            Button {
+                                lanMonitor.openTailscaleApp()
+                            } label: {
+                                Text("Open Tailscale")
+                                    .font(AppTheme.micro())
+                                    .foregroundStyle(AppTheme.ink)
+                                    .padding(.horizontal, 10)
+                                    .padding(.vertical, 5)
+                                    .background(AppTheme.surfaceSunken)
+                                    .clipShape(RoundedRectangle(cornerRadius: 6, style: .continuous))
+                            }
+                            .buttonStyle(ScaleButtonStyle())
+                        }
+                    }
+                    .padding(.horizontal, AppTheme.cardPad)
+                    .padding(.vertical, 12)
+                }
+            }
+            .background(Color.white)
+            .clipShape(RoundedRectangle(cornerRadius: AppTheme.radius, style: .continuous))
+            .shadow(color: AppTheme.cardShadow, radius: 12, x: 0, y: 2)
+            .animation(.spring(response: 0.3, dampingFraction: 0.8), value: store.useTailscaleWhenRemote)
+            .animation(.spring(response: 0.25, dampingFraction: 0.8), value: lanMonitor.isTailscaleActive)
+        }
+    }
+
     // MARK: — Notifications
 
     private var notificationSection: some View {

Services/BackupEngine.swift

@@ -20,6 +20,16 @@ final class BackupEngine: ObservableObject {
     ) async throws -> BackupResult {
         isCancelled = false
         let startDate = Date()
+        let store = ConnectionStore.shared
+        let lan = LANMonitor.shared
+
+        // Gate: block cellular unless user opted in (never block on LAN trigger)
+        if !triggeredByLAN && lan.isOnCellular && !store.allowCellularBackup {
+            throw BackupError.networkUnavailable
+        }
+
+        // Resolve effective host: use Tailscale when remote and tunnel is active
+        let host = resolveHost(connection: connection, store: store, lan: lan)
 
         // 1. Fetch assets
         job.prepare()
@@ -33,7 +43,7 @@ final class BackupEngine: ObservableObject {
         }
 
         try await transfer.connect(
-            to: connection.host,
+            to: host,
             port: connection.port,
             username: connection.username,
             password: connection.password
@@ -63,7 +73,6 @@ final class BackupEngine: ObservableObject {
 
             let remotePath = "\(connection.remotePath)/\(asset.filename)"
 
-            // Skip if exists (newFilesOnly = true in filter)
             if filter.newFilesOnly, (try? await transfer.fileExists(at: remotePath)) == true {
                 job.fileCompleted(skipped: true)
                 skipped += 1
@@ -74,7 +83,8 @@ final class BackupEngine: ObservableObject {
                 let localURL = try await photoService.exportAsset(asset)
                 defer { try? FileManager.default.removeItem(at: localURL) }
 
-                let fileSize = (try? localURL.resourceValues(forKeys: [.fileSizeKey]).fileSize).flatMap { Int64($0) } ?? 0
+                let fileSize = (try? localURL.resourceValues(forKeys: [.fileSizeKey]).fileSize)
+                    .flatMap { Int64($0) } ?? 0
 
                 try await transfer.upload(localURL: localURL, remotePath: remotePath) { sent, total in
                     let speed = speedTracker.update(bytesSent: sent)
@@ -109,22 +119,33 @@ final class BackupEngine: ObservableObject {
 
         job.finish(result: result)
 
-        // 5. Persist history
+        let entry = BackupHistoryEntry(result: result, nasHost: host, triggeredByLAN: triggeredByLAN)
-        let entry = BackupHistoryEntry(result: result, nasHost: connection.host, triggeredByLAN: triggeredByLAN)
+        store.appendHistoryEntry(entry)
-        ConnectionStore.shared.appendHistoryEntry(entry)
 
-        // 6. Push notification
         await sendCompletionNotification(result: result)
 
         return result
     }
 
+    // Returns the Tailscale host when outside the trusted network and tunnel is up,
+    // otherwise falls back to the saved local host.
+    private func resolveHost(connection: NASConnection, store: ConnectionStore, lan: LANMonitor) -> String {
+        let onTrustedLAN = store.trustedSSIDs.contains(lan.currentSSID ?? "")
+        guard !onTrustedLAN,
+              store.useTailscaleWhenRemote,
+              !store.tailscaleHost.isEmpty,
+              lan.isTailscaleActive else {
+            return connection.host
+        }
+        return store.tailscaleHost
+    }
+
     func cancel() {
         isCancelled = true
         job.cancel()
     }
 
-    func pause() { job.pause() }
+    func pause()  { job.pause() }
     func resume() { job.resume() }
 
     private func sendCompletionNotification(result: BackupResult) async {

Services/LANMonitor.swift

@@ -1,6 +1,8 @@
 import Foundation
 import Network
 import NetworkExtension
+import Darwin
+import UIKit
 import Combine
 
 @MainActor
@@ -9,6 +11,8 @@ final class LANMonitor: ObservableObject {
 
     @Published private(set) var isOnNetwork: Bool = false
     @Published private(set) var currentSSID: String? = nil
+    @Published private(set) var isOnCellular: Bool = false
+    @Published private(set) var isTailscaleActive: Bool = false
 
     private let monitor = NWPathMonitor()
     private let queue = DispatchQueue(label: "com.albert.nasbackup.lan", qos: .utility)
@@ -21,10 +25,11 @@ final class LANMonitor: ObservableObject {
         monitor.pathUpdateHandler = { [weak self] path in
             guard let self else { return }
             Task { @MainActor in
-                let satisfied = path.status == .satisfied
+                self.isOnNetwork   = path.status == .satisfied
-                self.isOnNetwork = satisfied
+                self.isOnCellular  = path.usesInterfaceType(.cellular)
+                self.isTailscaleActive = self.detectTailscale()
 
-                if satisfied {
+                if path.status == .satisfied {
                     await self.checkSSID()
                 } else {
                     self.currentSSID = nil
@@ -34,13 +39,36 @@ final class LANMonitor: ObservableObject {
         monitor.start(queue: queue)
     }
 
-    func stop() {
+    func stop() { monitor.cancel() }
-        monitor.cancel()
+
+    // Detect Tailscale: look for a utun interface with an IP in the 100.64.0.0/10 CGNAT range
+    private func detectTailscale() -> Bool {
+        var ifaddr: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&ifaddr) == 0 else { return false }
+        defer { freeifaddrs(ifaddr) }
+        var ptr = ifaddr
+        while let current = ptr {
+            defer { ptr = current.pointee.ifa_next }
+            let name = String(cString: current.pointee.ifa_name)
+            guard name.hasPrefix("utun"),
+                  let addr = current.pointee.ifa_addr,
+                  addr.pointee.sa_family == UInt8(AF_INET) else { continue }
+            var sa = addr.pointee
+            var buf = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            getnameinfo(&sa, socklen_t(sa.sa_len), &buf, socklen_t(buf.count), nil, 0, NI_NUMERICHOST)
+            if String(cString: buf).hasPrefix("100.") { return true }
+        }
+        return false
+    }
+
+    // Open the Tailscale app so the user can connect the VPN
+    func openTailscaleApp() {
+        guard let url = URL(string: "tailscale://") else { return }
+        UIApplication.shared.open(url)
     }
 
     private func checkSSID() async {
-        let ssid = await fetchCurrentSSID()
+        currentSSID = await fetchCurrentSSID()
-        self.currentSSID = ssid
     }
 
     func fetchCurrentSSID() async -> String? {

Shared/Components/ToggleRow.swift

@@ -30,6 +30,7 @@ struct ToggleRow: View {
                 .labelsHidden()
                 .tint(AppTheme.ink)
         }
-        .padding(.vertical, 2)
+        .padding(.horizontal, AppTheme.cardPad)
+        .padding(.vertical, 12)
     }
 }

Shared/Persistence/ConnectionStore.swift

@@ -41,19 +41,34 @@ final class ConnectionStore: ObservableObject {
     @Published var quietHoursEnd: Int {
         didSet { UserDefaults.standard.set(quietHoursEnd, forKey: "quietHoursEnd") }
     }
+
+    // Cellular & remote access
+    @Published var allowCellularBackup: Bool {
+        didSet { UserDefaults.standard.set(allowCellularBackup, forKey: "allowCellularBackup") }
+    }
+    @Published var useTailscaleWhenRemote: Bool {
+        didSet { UserDefaults.standard.set(useTailscaleWhenRemote, forKey: "useTailscaleWhenRemote") }
+    }
+    @Published var tailscaleHost: String {
+        didSet { UserDefaults.standard.set(tailscaleHost, forKey: "tailscaleHost") }
+    }
+
     @Published private(set) var historyEntries: [BackupHistoryEntry] = []
 
     private init() {
-        savedConnection   = ud(NASConnection.self, key: "savedConnection")
+        savedConnection        = ud(NASConnection.self, key: "savedConnection")
-        backupFilter      = ud(BackupFilter.self, key: "backupFilter") ?? BackupFilter()
+        backupFilter           = ud(BackupFilter.self, key: "backupFilter") ?? BackupFilter()
-        trustedSSIDs      = UserDefaults.standard.stringArray(forKey: "trustedSSIDs") ?? []
+        trustedSSIDs           = UserDefaults.standard.stringArray(forKey: "trustedSSIDs") ?? []
-        lanTriggerEnabled = UserDefaults.standard.object(forKey: "lanTriggerEnabled") as? Bool ?? true
+        lanTriggerEnabled      = UserDefaults.standard.object(forKey: "lanTriggerEnabled") as? Bool ?? true
-        startDelaySeconds = UserDefaults.standard.object(forKey: "startDelaySeconds") as? Int ?? 30
+        startDelaySeconds      = UserDefaults.standard.object(forKey: "startDelaySeconds") as? Int ?? 30
-        chargingOnlyMode  = UserDefaults.standard.object(forKey: "chargingOnlyMode") as? Bool ?? true
+        chargingOnlyMode       = UserDefaults.standard.object(forKey: "chargingOnlyMode") as? Bool ?? true
-        quietHoursEnabled = UserDefaults.standard.object(forKey: "quietHoursEnabled") as? Bool ?? false
+        quietHoursEnabled      = UserDefaults.standard.object(forKey: "quietHoursEnabled") as? Bool ?? false
-        quietHoursStart   = UserDefaults.standard.object(forKey: "quietHoursStart") as? Int ?? 23
+        quietHoursStart        = UserDefaults.standard.object(forKey: "quietHoursStart") as? Int ?? 23
-        quietHoursEnd     = UserDefaults.standard.object(forKey: "quietHoursEnd") as? Int ?? 7
+        quietHoursEnd          = UserDefaults.standard.object(forKey: "quietHoursEnd") as? Int ?? 7
-        historyEntries    = ud([BackupHistoryEntry].self, key: "historyEntries") ?? []
+        allowCellularBackup    = UserDefaults.standard.object(forKey: "allowCellularBackup") as? Bool ?? false
+        useTailscaleWhenRemote = UserDefaults.standard.object(forKey: "useTailscaleWhenRemote") as? Bool ?? false
+        tailscaleHost          = UserDefaults.standard.string(forKey: "tailscaleHost") ?? ""
+        historyEntries         = ud([BackupHistoryEntry].self, key: "historyEntries") ?? []
     }
 
     func appendHistoryEntry(_ entry: BackupHistoryEntry) {