Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -30,11 +30,41 @@ EXPO_PUBLIC_GEOAPIFY_API_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 # ETA/fare estimates. Note: this key is embedded in the client bundle.
 EXPO_PUBLIC_GOOGLE_API_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 
+# google cloud vision — reads a new driver's licence, ID card and vehicle
+# registration at onboarding so the credential fields prefill themselves.
+# SERVER-SIDE ONLY: no EXPO_PUBLIC_ prefix, so it is never bundled into the
+# app. Enable the Cloud Vision API on the project and restrict the key to it.
+# Leaving this unset does not break onboarding — scans are still stored for the
+# reviewer, the driver just types the details in by hand.
+GOOGLE_VISION_API_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# where driver uploads are written. Defaults to ./.uploads next to the app,
+# with two subdirectories: driver-documents/ (licence, ID and vehicle
+# registration scans) and driver-photos/ (the profile photo riders see).
+# Point this at a persistent volume in production — a redeploy that wipes it
+# leaves reviewers with no documents to check against and every driver without
+# a face. Never serve this directory statically: scans are read back only
+# through the authenticated /(api)/driver/documents route, and photos only
+# through /(api)/driver/photo, which serves a name no driver row references.
+UPLOAD_DIR=
+
 # areeba payment gateway (credentials issued after merchant onboarding)
 AREEBA_API_BASE_URL="https://your-gateway-host.areeba.com"
 AREEBA_MERCHANT_ID=XXXXXXXXXXXX
 AREEBA_API_PASSWORD=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 AREEBA_API_VERSION=100
 
-# admin dashboard origin for CORS (lib/admin.ts); defaults to * when unset
-ADMIN_CORS_ORIGIN=*
+# admin dashboard origin(s) for CORS (lib/admin.ts). Comma-separated, so dev
+# and production can both be listed. FAILS CLOSED: when unset, no
+# Access-Control-Allow-Origin header is sent at all and browsers block
+# cross-origin calls to the owner API — set it explicitly. "*" still works if
+# you deliberately want a wildcard, but it is no longer what you get by
+# forgetting to configure this.
+ADMIN_CORS_ORIGIN=http://localhost:5173
+
+# in-app WebRTC audio calls (STUN for dev; TURN mandatory for production NAT).
+# Leave TURN_* blank for development — STUN-only works on the same LAN.
+EXPO_PUBLIC_STUN_URL="stun:stun.l.google.com:19302"
+EXPO_PUBLIC_TURN_URL=""
+EXPO_PUBLIC_TURN_USERNAME=""
+EXPO_PUBLIC_TURN_CREDENTIAL=""