Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/admin.ts

@@ -1,20 +1,58 @@
 import { sql } from "@/lib/db";
 import { requireAuth } from "@/lib/jwt";
 
-export const corsHeaders: Record<string, string> = {
-  "Access-Control-Allow-Origin": process.env.ADMIN_CORS_ORIGIN ?? "*",
-  "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+// The owner API is cross-origin only for the admin dashboard, so the allowed
+// origin has to be named explicitly. An unset ADMIN_CORS_ORIGIN used to fall
+// back to "*", which meant a missing env var silently opened every owner
+// endpoint to every website the owner happened to have open. Fail closed
+// instead: with nothing configured we send no allow-origin header at all and
+// the browser blocks the call, which is a loud, obvious failure to fix.
+//
+// A comma-separated list is accepted so dev (localhost) and production can be
+// configured at once; the header echoes back whichever entry matched, since
+// "Access-Control-Allow-Origin" only ever takes a single value.
+const allowedOrigins = (): string[] =>
+  (process.env.ADMIN_CORS_ORIGIN ?? "")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+
+export const corsHeaders = (req: Request): Record<string, string> => {
+  const headers: Record<string, string> = {
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    Vary: "Origin",
+  };
+
+  const allowed = allowedOrigins();
+  if (allowed.length === 0) return headers;
+
+  // A wildcard is still honoured when it is configured deliberately — the
+  // change is that it is no longer what you get by forgetting to configure it.
+  if (allowed.includes("*")) {
+    headers["Access-Control-Allow-Origin"] = "*";
+    return headers;
+  }
+
+  const origin = req.headers.get("origin");
+  if (origin && allowed.includes(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+  }
+
+  return headers;
 };
 
-export const withCors = (response: Response): Response => {
-  for (const [key, value] of Object.entries(corsHeaders)) {
+// Takes the request first so the origin it echoes is never accidentally
+// omitted — a call site that forgets it won't compile.
+export const withCors = (req: Request, response: Response): Response => {
+  for (const [key, value] of Object.entries(corsHeaders(req))) {
     response.headers.set(key, value);
   }
   return response;
 };
 
-export const preflight = (): Response => withCors(new Response(null, { status: 204 }));
+export const preflight = (req: Request): Response =>
+  withCors(req, new Response(null, { status: 204 }));
 
 // Returns the authenticated owner or a ready-to-return error Response.
 export const requireOwner = async (