Add self-hosted auth, admin API, and owner web dashboard

- Replace Clerk with self-hosted JWT auth (register/login/verify, bcrypt
  passwords, Gmail OTP with console fallback)
- Add lib/db.ts pg pool + transaction helpers; seed script migrates legacy
  Clerk-era schema (drop clerk_id, enforce UUID ids and unique email)
- Add owner-gated admin API: stats, users, drivers CRUD, rides
- Add dashboard/ Vite React owner dashboard (login, overview, users,
  fleet, rides) with dev-server proxy to avoid Expo CORS middleware
- Add scripts/set-owner.mjs for role management

app/(api)/admin/users/[id]+api.ts

@@ -0,0 +1,60 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+type Body = {
+  role?: string | null;
+  email_verified?: boolean;
+};
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function PATCH(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const body = (await request.json()) as Body;
+
+    if (body.role !== undefined) {
+      const allowed = ["rider", "driver", "owner", null];
+      if (!allowed.includes(body.role)) {
+        return withCors(
+          Response.json(
+            { error: "Role must be rider, driver, owner or null." },
+            { status: 400 },
+          ),
+        );
+      }
+
+      if (id === auth.userId && body.role !== "owner") {
+        return withCors(
+          Response.json(
+            { error: "You cannot remove your own owner role." },
+            { status: 400 },
+          ),
+        );
+      }
+    }
+
+    const rows = await sql<{ id: string; role: string | null; email_verified: boolean }>`
+      UPDATE users SET
+        role = COALESCE(${body.role ?? null}, role),
+        email_verified = COALESCE(${body.email_verified ?? null}, email_verified)
+      WHERE id = ${id}
+      RETURNING id, role, email_verified
+    `;
+
+    if (!rows[0]) {
+      return withCors(Response.json({ error: "User not found." }, { status: 404 }));
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_USER_PATCH]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}