Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

app/(api)/auth/register+api.ts

@@ -1,18 +1,13 @@
-import { sql } from "@/lib/db";
+import { sql, transaction } from "@/lib/db";
 import { hashPassword } from "@/lib/password";
-import { sendEmail } from "@/lib/mailer";
+import { isDevOtpExposed, sendEmail } from "@/lib/mailer";
 import {
   CODE_TTL_MINUTES,
   generateCode,
   hashCode,
   verificationEmail,
 } from "@/lib/otp";
-
-const normalizePhone = (raw: string): string => {
-  const cleaned = raw.replace(/[^\d+]/g, "");
-  if (cleaned.startsWith("+")) return cleaned;
-  return `+961${cleaned.replace(/^0+/, "")}`;
-};
+import { normalizePhone } from "@/lib/utils";
 
 export async function POST(req: Request) {
   const { name, email, phone, password, role } = await req.json();
@@ -46,37 +41,42 @@ export async function POST(req: Request) {
     }
 
     // Unverified rows may be re-registered (e.g. the first mail never arrived).
-    await sql`
-      INSERT INTO users (name, email, phone, password_hash, email_verified, role)
-      VALUES (
-        ${name.trim()},
-        ${email.trim().toLowerCase()},
-        ${phone ? normalizePhone(phone) : null},
-        ${hashPassword(password)},
-        FALSE,
-        ${normalizedRole}
-      )
-      ON CONFLICT (email) DO UPDATE SET
-        name = EXCLUDED.name,
-        phone = COALESCE(EXCLUDED.phone, users.phone),
-        password_hash = EXCLUDED.password_hash,
-        role = EXCLUDED.role
-    `;
+    const code = await transaction(async (tx) => {
+      await tx`
+        INSERT INTO users (name, email, phone, password_hash, email_verified, role)
+        VALUES (
+          ${name.trim()},
+          ${email.trim().toLowerCase()},
+          ${phone ? normalizePhone(phone) : null},
+          ${hashPassword(password)},
+          FALSE,
+          ${normalizedRole}
+        )
+        ON CONFLICT (email) DO UPDATE SET
+          name = EXCLUDED.name,
+          phone = COALESCE(EXCLUDED.phone, users.phone),
+          password_hash = EXCLUDED.password_hash,
+          role = EXCLUDED.role
+        WHERE users.email_verified = FALSE
+      `;
 
-    const code = generateCode();
+      const generated = generateCode();
 
-    await sql`
-      INSERT INTO email_verification_codes (email, code_hash, expires_at)
-      VALUES (
-        ${email.trim().toLowerCase()},
-        ${hashCode(email.trim().toLowerCase(), code)},
-        CURRENT_TIMESTAMP + make_interval(mins => ${CODE_TTL_MINUTES})
-      )
-      ON CONFLICT (email) DO UPDATE SET
-        code_hash = EXCLUDED.code_hash,
-        expires_at = EXCLUDED.expires_at,
-        attempts = 0
-    `;
+      await tx`
+        INSERT INTO email_verification_codes (email, code_hash, expires_at)
+        VALUES (
+          ${email.trim().toLowerCase()},
+          ${hashCode(email.trim().toLowerCase(), generated)},
+          CURRENT_TIMESTAMP + make_interval(mins => ${CODE_TTL_MINUTES})
+        )
+        ON CONFLICT (email) DO UPDATE SET
+          code_hash = EXCLUDED.code_hash,
+          expires_at = EXCLUDED.expires_at,
+          attempts = 0
+      `;
+
+      return generated;
+    });
 
     const mail = verificationEmail(code);
     const delivered = await sendEmail(
@@ -90,8 +90,9 @@ export async function POST(req: Request) {
         data: {
           sent: delivered,
           // Without SMTP/Gmail configured there is nothing to receive, so
-          // surface the code to keep self-hosted sign-up usable.
-          ...(delivered ? {} : { devCode: code }),
+          // surface the code to keep self-hosted sign-up usable. Never expose
+          // the code in production, even on delivery failure.
+          ...(delivered || !isDevOtpExposed() ? {} : { devCode: code }),
         },
       },
       { status: 201 },