Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

app/(api)/auth/reset-password+api.ts

@@ -1,4 +1,4 @@
-import { sql } from "@/lib/db";
+import { transaction } from "@/lib/db";
 import { MAX_CODE_ATTEMPTS, codeMatches } from "@/lib/otp";
 import { hashPassword } from "@/lib/password";
 import { issueSession, toProfile } from "@/lib/users";
@@ -24,52 +24,67 @@ export async function POST(req: Request) {
 
   try {
     // Charge the attempt before comparing so concurrent guesses can't race
-    // past the cap, and so a correct guess still costs one of the five.
-    const attempts = await sql<{ code_hash: string; attempts: number }>`
-      UPDATE password_reset_codes
-      SET attempts = attempts + 1
-      WHERE email = ${normalized} AND expires_at > CURRENT_TIMESTAMP
-      RETURNING code_hash, attempts
-    `;
+    // past the cap, and so a correct guess still costs one of the five. Wrap
+    // the attempt charge, password update, and code cleanup in one
+    // transaction.
+    const result = await transaction(async (tx) => {
+      const attempts = await tx<{ code_hash: string; attempts: number }>`
+        UPDATE password_reset_codes
+        SET attempts = attempts + 1
+        WHERE email = ${normalized} AND expires_at > CURRENT_TIMESTAMP
+        RETURNING code_hash, attempts
+      `;
 
-    const record = attempts[0];
+      const record = attempts[0];
 
-    if (
-      !record ||
-      record.attempts > MAX_CODE_ATTEMPTS ||
-      !codeMatches(record.code_hash, normalized, code)
-    ) {
+      if (
+        !record ||
+        record.attempts > MAX_CODE_ATTEMPTS ||
+        !codeMatches(record.code_hash, normalized, code)
+      ) {
+        return { kind: "invalid" as const };
+      }
+
+      // A successful reset also proves control of the mailbox, so verify it
+      // too.
+      const rows = await tx<{
+        id: string;
+        name: string;
+        email: string;
+        role: string | null;
+      }>`
+        UPDATE users
+        SET password_hash = ${hashPassword(password)}, email_verified = TRUE
+        WHERE email = ${normalized}
+        RETURNING id, name, email, role
+      `;
+
+      const user = rows[0];
+
+      if (!user) {
+        return { kind: "not_found" as const };
+      }
+
+      await tx`DELETE FROM password_reset_codes WHERE email = ${normalized}`;
+
+      return { kind: "ok" as const, user };
+    });
+
+    if (result.kind === "invalid") {
       return Response.json(
         { error: "Invalid or expired reset code." },
         { status: 400 },
       );
     }
 
-    // A successful reset also proves control of the mailbox, so verify it too.
-    const rows = await sql<{
-      id: string;
-      name: string;
-      email: string;
-      role: string | null;
-    }>`
-      UPDATE users
-      SET password_hash = ${hashPassword(password)}, email_verified = TRUE
-      WHERE email = ${normalized}
-      RETURNING id, name, email, role
-    `;
-
-    const user = rows[0];
-
-    if (!user) {
+    if (result.kind === "not_found") {
       return Response.json({ error: "User not found." }, { status: 404 });
     }
 
-    await sql`DELETE FROM password_reset_codes WHERE email = ${normalized}`;
-
-    const session = issueSession(user);
+    const session = issueSession(result.user);
 
     return Response.json({
-      data: { token: session.token, user: toProfile(user) },
+      data: { token: session.token, user: toProfile(result.user) },
     });
   } catch (error) {
     console.error("[RESET_PASSWORD]: ", error);