Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(api)/ride/active+api.ts

@@ -0,0 +1,82 @@
+import { sql } from "@/lib/db";
+import { requireAuth } from "@/lib/jwt";
+import { ACTIVE_STATUS_ARRAY, expireStaleRequests } from "@/lib/ride-lifecycle";
+
+// GET — "does this rider have unfinished business?", answered in one call.
+//
+//   active         : a ride still in flight (requested/accepted/arrived/en_route).
+//                    Killing the app used to strand a rider away from their
+//                    tracking screen with no way back; the home banner reads
+//                    this to put them back on it.
+//   pending_rating : a ride that finished recently and hasn't been rated yet,
+//                    so the prompt survives the app being backgrounded at
+//                    drop-off — the moment ratings are most often lost.
+export async function GET(req: Request) {
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
+
+  try {
+    // Sweep searches that have run past the TTL (unscoped — this is one of the
+    // lazy paths that stands in for a background worker), so the banner never
+    // advertises a ride that is really long dead.
+    await expireStaleRequests();
+
+    const active = await sql<{
+      ride_id: number;
+      status: string;
+      service: string;
+      origin_address: string;
+      destination_address: string;
+      fare_price: number;
+      driver_name: string | null;
+    }>`
+      SELECT
+        r.ride_id, r.status, r.service,
+        r.origin_address, r.destination_address, r.fare_price,
+        NULLIF(TRIM(COALESCE(d.first_name, '') || ' ' || COALESCE(d.last_name, '')), '')
+          AS driver_name
+      FROM rides r
+      LEFT JOIN drivers d ON d.id = r.driver_id
+      WHERE r.user_id = ${auth.userId}
+        AND r.status = ANY(${ACTIVE_STATUS_ARRAY}::text[])
+      ORDER BY r.created_at DESC
+      LIMIT 1
+    `;
+
+    // Only prompt for rides that ended in the last day — a week-old ride is a
+    // nag, not a reminder.
+    const pending = await sql<{
+      ride_id: number;
+      destination_address: string;
+      driver_name: string | null;
+      driver_avatar: string | null;
+    }>`
+      SELECT
+        r.ride_id, r.destination_address,
+        NULLIF(TRIM(COALESCE(d.first_name, '') || ' ' || COALESCE(d.last_name, '')), '')
+          AS driver_name,
+        d.profile_image_url AS driver_avatar
+      FROM rides r
+      LEFT JOIN drivers d ON d.id = r.driver_id
+      WHERE r.user_id = ${auth.userId}
+        AND r.status = 'completed'
+        AND r.completed_at > CURRENT_TIMESTAMP - INTERVAL '1 day'
+        AND NOT EXISTS (
+          SELECT 1 FROM ride_ratings rr
+          WHERE rr.ride_id = r.ride_id AND rr.rater_type = 'rider'
+        )
+      ORDER BY r.completed_at DESC
+      LIMIT 1
+    `;
+
+    return Response.json({
+      data: {
+        active: active[0] ?? null,
+        pending_rating: pending[0] ?? null,
+      },
+    });
+  } catch (error) {
+    console.error("[RIDE_ACTIVE]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}