Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

lib/request-ride.ts

@@ -0,0 +1,112 @@
+import * as WebBrowser from "expo-web-browser";
+
+import { ApiError, fetchAPI } from "@/lib/fetch";
+import type { ServiceId } from "@/constants/services";
+import type { Ride } from "@/types/type";
+
+// The rider's request flow, used by the confirm-ride screen. This is the card
+// (Areeba hosted checkout -> server verify -> consume order -> create ride)
+// and cash (create ride directly) paths, now unified behind one entry point so
+// the screen doesn't re-implement the gateway dance.
+//
+// The ride is always created with status='requested' and driver_id=null; the
+// server's auto-match engine assigns a driver asynchronously. Returns the
+// created ride so the caller can navigate to the status screen.
+
+export type RequestInput = {
+  method: "cash" | "card";
+  service: ServiceId;
+  user: { name: string; email: string };
+  // Location snapshot at request time.
+  origin: { address: string; latitude: number; longitude: number };
+  destination: { address: string; latitude: number; longitude: number };
+  rideTimeSeconds: number;
+  fareCents: number;
+};
+
+export type RequestResult = { ride: Ride };
+
+const recordRide = async (
+  input: RequestInput,
+  method: "cash" | "card",
+  orderId?: string,
+): Promise<Ride> => {
+  const res = await fetchAPI("/(api)/ride/create", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      origin_address: input.origin.address,
+      destination_address: input.destination.address,
+      origin_latitude: input.origin.latitude,
+      origin_longitude: input.origin.longitude,
+      destination_latitude: input.destination.latitude,
+      destination_longitude: input.destination.longitude,
+      ride_time: Math.round(input.rideTimeSeconds),
+      fare_price: input.fareCents,
+      payment_method: method,
+      service: input.service,
+      ...(orderId ? { payment_order_id: orderId } : {}),
+    }),
+  });
+  return res.data as Ride;
+};
+
+export const requestRide = async (input: RequestInput): Promise<RequestResult> => {
+  if (input.method === "cash") {
+    const ride = await recordRide(input, "cash");
+    return { ride };
+  }
+
+  // Card: create an Areeba checkout session on our server.
+  const { orderId, checkoutUrl, error } = await fetchAPI(
+    "/(api)/(areeba)/create",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: input.user.name || input.user.email,
+        email: input.user.email,
+        fare_cents: input.fareCents,
+        origin_address: input.origin.address,
+        destination_address: input.destination.address,
+        origin_latitude: input.origin.latitude,
+        origin_longitude: input.origin.longitude,
+        destination_latitude: input.destination.latitude,
+        destination_longitude: input.destination.longitude,
+        ride_time: Math.round(input.rideTimeSeconds),
+      }),
+    },
+  );
+  if (error || !checkoutUrl) throw new Error(error || "No checkout URL");
+
+  // Open Areeba's hosted payment page. After payment the gateway redirects
+  // back to the app (waseel://book-ride).
+  const browserResult = await WebBrowser.openAuthSessionAsync(
+    checkoutUrl,
+    "waseel://book-ride",
+  );
+
+  let resultIndicator: string | undefined;
+  if (browserResult.type === "success" && browserResult.url) {
+    resultIndicator = new URL(browserResult.url).searchParams.get(
+      "resultIndicator",
+    ) ?? undefined;
+  }
+
+  // Verify the payment server-side.
+  const verification = await fetchAPI("/(api)/(areeba)/verify", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ orderId, resultIndicator }),
+  });
+
+  if (!verification.success) {
+    throw new ApiError(
+      400,
+      "Your payment was cancelled or could not be verified. Please try again.",
+    );
+  }
+
+  const ride = await recordRide(input, "card", orderId);
+  return { ride };
+};