Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/token-store.ts

@@ -0,0 +1,22 @@
+// Where the session token lives on disk.
+//
+// Split out of lib/session.tsx so the background location task can read the
+// token without importing the session provider: the task module is imported
+// by app/_layout at bundle evaluation, and sign-out needs to stop the task —
+// pointing those two at each other would be an import cycle. Both depend on
+// this leaf instead.
+
+import * as SecureStore from "expo-secure-store";
+
+export const TOKEN_KEY = "waseel_auth_token";
+
+/**
+ * The stored session token, read straight from secure storage.
+ *
+ * Normal requests use the in-memory copy in lib/fetch, which the session
+ * provider sets on sign-in. The background location task can't rely on that:
+ * Android may restart the app process headlessly to deliver a location update,
+ * with no React tree run and therefore no token in memory.
+ */
+export const readStoredToken = (): Promise<string | null> =>
+  SecureStore.getItemAsync(TOKEN_KEY);