Add secure public driver training profiles

README.md

@@ -187,6 +187,29 @@ Training statistics currently include only valid laps linked to a registered dri
 
 Judging corrections update ledger laps while the source session still exists. Once a session is deleted, its synchronized training laps remain in the ledger so lifetime progression is not lost. Full data export includes the ledger and reward goals.
 
+### Read-only mobile profile
+
+Each registered driver can have an optional personal mobile link:
+
+1. Open `Training` and select the driver.
+2. Click `Enable mobile profile`.
+3. Copy or open the generated link.
+4. Use `Create new link` to revoke the previous URL, or `Disable profile` to turn sharing off.
+
+The URL uses a 192-bit random bearer token rather than a driver ID. The public API returns only that driver's display name, class/brand, aggregate practice statistics, daily summaries, goals and reward text. It does not return transponder IDs, other driver names, race setup or admin state.
+
+The mobile page also includes a local 20-minute practice timer: 10 minutes maximum focus followed by 10 minutes controlled 80-90% driving. Timer state stays in that phone's browser and does not modify race data.
+
+For internet publishing, proxy only these paths:
+
+```text
+/public-training/*
+/src/public_training.js
+/src/public_training.css
+```
+
+Do not expose `/api/state` or the full admin application. Static serving is restricted to `/src` and `/docs`; `data/`, server scripts and bundled binaries are not public static files.
+
 
 ## Create Race Wizard
 - `Race Setup` now starts with a four-step wizard for new races: