Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(api)/admin/users/[id]+api.ts

@@ -6,13 +6,13 @@ type Body = {
   email_verified?: boolean;
 };
 
-export async function OPTIONS() {
-  return preflight();
+export async function OPTIONS(request: Request) {
+  return preflight(request);
 }
 
 export async function PATCH(request: Request, { id }: { id: string }) {
   const auth = await requireOwner(request);
-  if ("error" in auth) return withCors(auth.error);
+  if ("error" in auth) return withCors(request, auth.error);
 
   try {
     const body = (await request.json()) as Body;
@@ -20,7 +20,7 @@ export async function PATCH(request: Request, { id }: { id: string }) {
     if (body.role !== undefined) {
       const allowed = ["rider", "driver", "owner", null];
       if (!allowed.includes(body.role)) {
-        return withCors(
+        return withCors(request,
           Response.json(
             { error: "Role must be rider, driver, owner or null." },
             { status: 400 },
@@ -29,7 +29,7 @@ export async function PATCH(request: Request, { id }: { id: string }) {
       }
 
       if (id === auth.userId && body.role !== "owner") {
-        return withCors(
+        return withCors(request,
           Response.json(
             { error: "You cannot remove your own owner role." },
             { status: 400 },
@@ -47,13 +47,13 @@ export async function PATCH(request: Request, { id }: { id: string }) {
     `;
 
     if (!rows[0]) {
-      return withCors(Response.json({ error: "User not found." }, { status: 404 }));
+      return withCors(request, Response.json({ error: "User not found." }, { status: 404 }));
     }
 
-    return withCors(Response.json({ data: rows[0] }));
+    return withCors(request, Response.json({ data: rows[0] }));
   } catch (error) {
     console.error("[ADMIN_USER_PATCH]: ", error);
-    return withCors(
+    return withCors(request,
       Response.json({ error: "Internal Server Error" }, { status: 500 }),
     );
   }
@@ -61,10 +61,10 @@ export async function PATCH(request: Request, { id }: { id: string }) {
 
 export async function DELETE(request: Request, { id }: { id: string }) {
   const auth = await requireOwner(request);
-  if ("error" in auth) return withCors(auth.error);
+  if ("error" in auth) return withCors(request, auth.error);
 
   if (id === auth.userId) {
-    return withCors(
+    return withCors(request,
       Response.json(
         { error: "You cannot delete your own account." },
         { status: 400 },
@@ -79,15 +79,15 @@ export async function DELETE(request: Request, { id }: { id: string }) {
     `;
 
     if (!rows[0]) {
-      return withCors(
+      return withCors(request,
         Response.json({ error: "User not found." }, { status: 404 }),
       );
     }
 
-    return withCors(Response.json({ data: rows[0] }));
+    return withCors(request, Response.json({ data: rows[0] }));
   } catch (error) {
     console.error("[ADMIN_USER_DELETE]: ", error);
-    return withCors(
+    return withCors(request,
       Response.json({ error: "Internal Server Error" }, { status: 500 }),
     );
   }