Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

app.config.js

@@ -1,64 +1,67 @@
-// Dynamic config layered over app.json.
+// Dynamic Expo config. We use a JS config (rather than static app.json) so the
+// Android Google Maps API key can be pulled from EXPO_PUBLIC_GOOGLE_API_KEY
+// at build time without committing the key to the repo.
 //
-// react-native-maps reads the Google Maps key from the *native* manifest
-// (AndroidManifest `com.google.android.geo.API_KEY`), not from the JS bundle,
-// so EXPO_PUBLIC_GOOGLE_API_KEY has to be injected here at build time. Without
-// it Android renders an empty grey tile area instead of a map.
+// react-native-maps renders blank tiles (just the Google logo, nothing else)
+// on Android when no Maps API key is set in the AndroidManifest. Expo's
+// prebuild reads `android.config.googleMaps.apiKey` and writes it to the
+// manifest as com.google.android.geo.API_KEY — that is what makes the map
+// actually draw. On iOS the default provider is Apple Maps, which needs no
+// key, so nothing is injected there.
 
 const googleMapsApiKey = process.env.EXPO_PUBLIC_GOOGLE_API_KEY;
 
-const LOCATION_PERMISSION =
-  "Waseel uses your location to show nearby drivers and set your pickup point.";
-
-module.exports = ({ config }) => {
-  if (!googleMapsApiKey) {
-    const message =
-      "EXPO_PUBLIC_GOOGLE_API_KEY is not set — the Android manifest will have no " +
-      "Maps key and the map will render blank.";
-
-    // `.env` is gitignored, so it is never uploaded to EAS. Unless the key is
-    // also registered as an EAS environment variable the build silently
-    // produces a keyless APK, and the blank map only shows up on the device.
-    // Fail the build here rather than shipping that.
-    if (process.env.EAS_BUILD) {
-      throw new Error(
-        `[app.config] ${message} Register it with \`eas env:create\` (or in the ` +
-          "EAS dashboard) for this build profile.",
-      );
-    }
-
-    console.warn(`[app.config] ${message}`);
-  }
-
-  return {
-    ...config,
-    ios: {
-      ...config.ios,
-      // iOS uses Apple Maps via PROVIDER_DEFAULT, so this only matters if the
-      // Map component is switched to PROVIDER_GOOGLE.
-      config: { ...config.ios?.config, googleMapsApiKey },
-      infoPlist: {
-        ...config.ios?.infoPlist,
-        NSLocationWhenInUseUsageDescription: LOCATION_PERMISSION,
+module.exports = ({ config }) => ({
+  ...config,
+  name: "Waseel",
+  description: "Find your perfect ride with Waseel.",
+  githubUrl: "https://github.com/sanidhyy/uber-clone",
+  slug: "waseel",
+  version: "1.0.0",
+  orientation: "portrait",
+  icon: "./assets/images/icon.png",
+  scheme: "waseel",
+  userInterfaceStyle: "automatic",
+  splash: {
+    image: "./assets/images/splash.png",
+    resizeMode: "contain",
+    backgroundColor: "#2F80ED",
+  },
+  ios: {
+    supportsTablet: true,
+    bundleIdentifier: "com.waseel.app",
+  },
+  android: {
+    adaptiveIcon: {
+      foregroundImage: "./assets/images/adaptive-icon.png",
+      backgroundColor: "#ffffff",
+    },
+    package: "com.waseel.app",
+    config: {
+      googleMaps: {
+        apiKey: googleMapsApiKey ?? "",
       },
     },
-    android: {
-      ...config.android,
-      config: {
-        ...config.android?.config,
-        googleMaps: { apiKey: googleMapsApiKey },
+  },
+  web: {
+    bundler: "metro",
+    output: "server",
+    favicon: "./assets/images/favicon.png",
+  },
+  plugins: [
+    [
+      "expo-router",
+      {
+        origin: "https://example.com/",
       },
-      // Location permissions come from the expo-location plugin below.
-    },
-    plugins: [
-      ...(config.plugins ?? []),
-      [
-        "expo-location",
-        {
-          locationAlwaysAndWhenInUsePermission: LOCATION_PERMISSION,
-          locationWhenInUsePermission: LOCATION_PERMISSION,
-        },
-      ],
     ],
-  };
-};
+  ],
+  experiments: {
+    typedRoutes: true,
+  },
+  extra: {
+    router: {
+      origin: "https://example.com/",
+    },
+  },
+});