Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(api)/admin/drivers/[id]+api.ts

@@ -1,8 +1,9 @@
 import { requireOwner, withCors, preflight } from "@/lib/admin";
 import { sql } from "@/lib/db";
+import { isApprovalStatus } from "@/lib/driver";
 
-export async function OPTIONS() {
-  return preflight();
+export async function OPTIONS(request: Request) {
+  return preflight(request);
 }
 
 type DriverBody = {
@@ -12,15 +13,53 @@ type DriverBody = {
   car_image_url?: string;
   car_seats?: number;
   rating?: number;
+  /** Vetting decision: 'approved' | 'rejected' | 'suspended' | 'pending'. */
+  approval_status?: string;
+  /** Shown to the driver when the decision is 'rejected'. */
+  rejection_reason?: string;
 };
 
 export async function PATCH(request: Request, { id }: { id: string }) {
   const auth = await requireOwner(request);
-  if ("error" in auth) return withCors(auth.error);
+  if ("error" in auth) return withCors(request, auth.error);
 
   try {
     const body = (await request.json()) as DriverBody;
 
+    // Vetting decision. Anything other than 'approved' also forces the driver
+    // offline in the same statement: a driver who is suspended mid-shift must
+    // stop receiving offers immediately, not at their next toggle.
+    let approval: string | null = null;
+    if (body.approval_status !== undefined) {
+      if (!isApprovalStatus(body.approval_status)) {
+        return withCors(
+          request,
+          Response.json(
+            {
+              error:
+                "approval_status must be pending, approved, rejected or suspended.",
+            },
+            { status: 400 },
+          ),
+        );
+      }
+
+      if (body.approval_status === "rejected" && !body.rejection_reason?.trim()) {
+        return withCors(
+          request,
+          Response.json(
+            { error: "A rejection needs a reason the driver can act on." },
+            { status: 400 },
+          ),
+        );
+      }
+
+      approval = body.approval_status;
+    }
+
+    const rejectionReason =
+      approval === "approved" ? null : (body.rejection_reason?.trim() ?? null);
+
     const rows = await sql`
       UPDATE drivers SET
         first_name = COALESCE(${body.first_name ?? null}, first_name),
@@ -28,21 +67,39 @@ export async function PATCH(request: Request, { id }: { id: string }) {
         profile_image_url = COALESCE(${body.profile_image_url ?? null}, profile_image_url),
         car_image_url = COALESCE(${body.car_image_url ?? null}, car_image_url),
         car_seats = COALESCE(${body.car_seats ?? null}, car_seats),
-        rating = COALESCE(${body.rating ?? null}, rating)
+        rating = COALESCE(${body.rating ?? null}, rating),
+        approval_status = COALESCE(${approval}, approval_status),
+        rejection_reason = CASE
+          WHEN ${approval}::text IS NULL THEN rejection_reason
+          ELSE ${rejectionReason}
+        END,
+        reviewed_at = CASE
+          WHEN ${approval}::text IS NULL THEN reviewed_at
+          ELSE CURRENT_TIMESTAMP
+        END,
+        reviewed_by = CASE
+          WHEN ${approval}::text IS NULL THEN reviewed_by
+          ELSE ${auth.userId}::uuid
+        END,
+        online = CASE
+          WHEN ${approval}::text IS NOT NULL AND ${approval}::text <> 'approved'
+            THEN FALSE
+          ELSE online
+        END
       WHERE id = ${id}
       RETURNING *
     `;
 
     if (!rows[0]) {
-      return withCors(
+      return withCors(request,
         Response.json({ error: "Driver not found." }, { status: 404 }),
       );
     }
 
-    return withCors(Response.json({ data: rows[0] }));
+    return withCors(request, Response.json({ data: rows[0] }));
   } catch (error) {
     console.error("[ADMIN_DRIVER_PATCH]: ", error);
-    return withCors(
+    return withCors(request,
       Response.json({ error: "Internal Server Error" }, { status: 500 }),
     );
   }
@@ -50,7 +107,7 @@ export async function PATCH(request: Request, { id }: { id: string }) {
 
 export async function DELETE(request: Request, { id }: { id: string }) {
   const auth = await requireOwner(request);
-  if ("error" in auth) return withCors(auth.error);
+  if ("error" in auth) return withCors(request, auth.error);
 
   try {
     const used = await sql<{ n: number }>`
@@ -58,7 +115,7 @@ export async function DELETE(request: Request, { id }: { id: string }) {
     `;
 
     if (used[0].n > 0) {
-      return withCors(
+      return withCors(request,
         Response.json(
           { error: "Driver has recorded rides and cannot be deleted." },
           { status: 409 },
@@ -71,15 +128,15 @@ export async function DELETE(request: Request, { id }: { id: string }) {
     `;
 
     if (!rows[0]) {
-      return withCors(
+      return withCors(request,
         Response.json({ error: "Driver not found." }, { status: 404 }),
       );
     }
 
-    return withCors(Response.json({ data: rows[0] }));
+    return withCors(request, Response.json({ data: rows[0] }));
   } catch (error) {
     console.error("[ADMIN_DRIVER_DELETE]: ", error);
-    return withCors(
+    return withCors(request,
       Response.json({ error: "Internal Server Error" }, { status: 500 }),
     );
   }