docs(streams): document phase4 on-demand APIs and web simulator

Backend/README.md

@@ -122,6 +122,20 @@ Motion realtime events:
 - Linked clients receive `motion:detected` as soon as camera starts event.
 - Linked clients receive `motion:ended` when camera ends event.
 
+### On-Demand Streams (Phase 4)
+| Endpoint | Purpose |
+| --- | --- |
+| `POST /streams/request` | Client device requests a linked camera to start a live stream |
+| `POST /streams/:streamSessionId/accept` | Camera device accepts and transitions stream session to `streaming` |
+| `POST /streams/:streamSessionId/end` | Requester/camera ends an existing stream session |
+| `GET /streams/:streamSessionId/playback-token` | Obtain short-lived playback token for active stream |
+| `GET /streams/me/list` | List stream sessions for the current device |
+
+Stream realtime events:
+- Client receives `stream:requested` after request creation.
+- Client receives `stream:started` when camera accepts.
+- Both devices receive `stream:ended` when session is closed.
+
 ### API Docs
 OpenAPI docs are generated from Zod/OpenAPI definitions:
 
@@ -130,6 +144,13 @@ OpenAPI docs are generated from Zod/OpenAPI definitions:
 | `GET /openapi.json` | OpenAPI 3 spec (JSON) |
 | `GET /docs` | Swagger UI |
 
+### Web Mobile Simulator
+Use `GET /sim/mobile-sim.html` to run a browser simulator that behaves like the mobile app:
+- Register as `camera` or `client`
+- Connect Socket.IO with bearer device token
+- Camera: process incoming `start_stream` commands, start/end motion events
+- Client: create links, request streams, and fetch playback tokens
+
 ### Admin Dashboard
 Access `/admin` with Basic auth to: