Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(api)/admin/rides+api.ts

@@ -1,8 +1,19 @@
 import { requireOwner, withCors, preflight } from "@/lib/admin";
 import { query, type SqlValue } from "@/lib/db";
+import { RIDE_STATUSES as LIFECYCLE_STATUSES } from "@/lib/ride-lifecycle";
 
 const PAGE_SIZE = 25;
 
+// Lowercased for comparison against the `status` query param.
+const RIDE_STATUSES: readonly string[] = LIFECYCLE_STATUSES;
+
+// LEFT JOIN on drivers, deliberately.
+//
+// This was an INNER JOIN, which meant every ride without a driver was missing
+// from the admin list entirely — a rider cancelling before a match, or a
+// request that expired with nobody available, simply never appeared. Those are
+// exactly the rides an operator needs to see: they're the ones that went
+// wrong.
 const SELECT_RIDES = `
   SELECT
     r.ride_id,
@@ -11,26 +22,36 @@ const SELECT_RIDES = `
     r.ride_time,
     r.fare_price,
     r.payment_status,
+    r.status,
+    r.cancelled_by,
+    r.cancellation_reason,
+    r.platform_fee_cents,
+    r.driver_payout_cents,
+    r.commission_rate,
+    r.platform_fee_settled_at,
+    r.driver_payout_settled_at,
+    r.settlement_note,
     r.created_at,
+    r.completed_at,
     u.id AS user_id,
     u.email AS user_email,
-    json_build_object(
+    CASE WHEN d.id IS NULL THEN NULL ELSE json_build_object(
       'driver_id', d.id,
       'name', d.first_name || ' ' || d.last_name,
       'rating', d.rating
-    ) AS driver
+    ) END AS driver
   FROM rides r
-  INNER JOIN drivers d ON d.id = r.driver_id
+  LEFT JOIN drivers d ON d.id = r.driver_id
   INNER JOIN users u ON u.id = r.user_id
 `;
 
-export async function OPTIONS() {
-  return preflight();
+export async function OPTIONS(request: Request) {
+  return preflight(request);
 }
 
 export async function GET(request: Request) {
   const auth = await requireOwner(request);
-  if ("error" in auth) return withCors(auth.error);
+  if ("error" in auth) return withCors(request, auth.error);
 
   try {
     const url = new URL(request.url);
@@ -41,9 +62,18 @@ export async function GET(request: Request) {
     const conds: string[] = [];
     const params: SqlValue[] = [];
 
+    // `status` filters the ride's own lifecycle state when it names one, and
+    // falls back to the payment status otherwise — so the existing "paid" /
+    // "cash" filters keep working while "cancelled" and "completed" become
+    // filterable too, which is what an operator actually reaches for.
     if (status) {
       params.push(status);
-      conds.push(`LOWER(r.payment_status) = $${params.length}`);
+      const n = params.length;
+      conds.push(
+        RIDE_STATUSES.includes(status)
+          ? `LOWER(r.status) = $${n}`
+          : `LOWER(r.payment_status) = $${n}`,
+      );
     }
 
     if (q) {
@@ -60,7 +90,7 @@ export async function GET(request: Request) {
     const [{ count }] = await query<{ count: number }>(
       `SELECT COUNT(*)::int AS count
        FROM rides r
-       INNER JOIN drivers d ON d.id = r.driver_id
+       LEFT JOIN drivers d ON d.id = r.driver_id
        INNER JOIN users u ON u.id = r.user_id${where}`,
       params,
     );
@@ -72,7 +102,7 @@ export async function GET(request: Request) {
       [...params, PAGE_SIZE, (page - 1) * PAGE_SIZE],
     );
 
-    return withCors(
+    return withCors(request,
       Response.json({
         data: rows,
         total: count,
@@ -83,7 +113,7 @@ export async function GET(request: Request) {
     );
   } catch (error) {
     console.error("[ADMIN_RIDES]: ", error);
-    return withCors(
+    return withCors(request,
       Response.json({ error: "Internal Server Error" }, { status: 500 }),
     );
   }