Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

app/(api)/ride/[id]/respond+api.ts

@@ -0,0 +1,102 @@
+import { requireDriverProfile } from "@/lib/driver";
+import { transaction } from "@/lib/db";
+import { matchNextDriver } from "@/lib/dispatch";
+
+// POST — a driver responds to a ride offer.
+//   { action: 'accept' } — claim the ride: offer -> accepted, ride -> accepted,
+//                          ride.driver_id set to this driver. Guarded so only
+//                          the offered driver can accept, and only while the
+//                          offer is still 'offered' (not expired/timed out).
+//   { action: 'decline' } — release the ride: offer -> declined, then offer
+//                           it to the next-nearest driver via matchNextDriver.
+export async function POST(req: Request, { id }: { id: string }) {
+  const rideId = Number(id);
+  if (!Number.isInteger(rideId)) {
+    return Response.json({ error: "Invalid ride id." }, { status: 400 });
+  }
+
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  const { driverId } = result;
+
+  let body: { action?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON body." }, { status: 400 });
+  }
+
+  const action = body.action;
+  if (action !== "accept" && action !== "decline") {
+    return Response.json(
+      { error: "action must be 'accept' or 'decline'." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    if (action === "accept") {
+      const claimed = await transaction(async (tx) => {
+        // Atomically flip the offer to accepted only if it's still offered to
+        // this driver. This is the race guard: two drivers can't both accept,
+        // and an expired offer can't be revived.
+        const offer = await tx<{ id: number }>`
+          UPDATE ride_offers
+          SET status = 'accepted', responded_at = CURRENT_TIMESTAMP
+          WHERE ride_id = ${rideId}
+            AND driver_id = ${driverId}
+            AND status = 'offered'
+          RETURNING id
+        `;
+        if (!offer[0]) return null;
+
+        // Assign the ride to this driver. The status='requested' guard means
+        // we never overwrite a ride another driver already accepted.
+        const ride = await tx`
+          UPDATE rides
+          SET status = 'accepted', driver_id = ${driverId}
+          WHERE ride_id = ${rideId} AND status = 'requested'
+          RETURNING ride_id
+        `;
+        if (!ride[0]) return null;
+
+        return offer[0].id;
+      });
+
+      if (claimed === null) {
+        return Response.json(
+          { error: "This offer is no longer available." },
+          { status: 409 },
+        );
+      }
+      return Response.json({ data: { action: "accepted" } });
+    }
+
+    // Decline: mark the offer declined and offer the ride to the next driver.
+    const declined = await transaction(async (tx) => {
+      const offer = await tx`
+        UPDATE ride_offers
+        SET status = 'declined', responded_at = CURRENT_TIMESTAMP
+        WHERE ride_id = ${rideId}
+          AND driver_id = ${driverId}
+          AND status = 'offered'
+        RETURNING id
+      `;
+      return offer[0]?.id ?? null;
+    });
+
+    if (declined === null) {
+      return Response.json(
+        { error: "This offer is no longer available." },
+        { status: 409 },
+      );
+    }
+
+    void matchNextDriver(rideId);
+    return Response.json({ data: { action: "declined" } });
+  } catch (error) {
+    console.error("[RIDE_RESPOND]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}