feat: miler self-set PIN on first login; no console-set default PIN

Milers now choose their own PIN the first time they log in, instead of the
console assigning a shared default:

- CreateMiler always creates a rider with an empty Password (PIN field removed
  from MilerCreateRequest); any client-supplied PIN is ignored, making
  "riders set their own PIN" a backend invariant, not a console convention.
- LoginMiler returns `pin_set` so the app routes to enter-PIN vs set-PIN.
- New POST /miler/set-pin (SetMilerPin): self-service first PIN, allowed ONLY
  when the account has none yet (409 otherwise, so it can't overwrite/take over
  an active account), then logs the rider in. Self-service and throttle-only is
  safe because of that guard; OTP-gate it once the SMS gateway is live.
- verify-pin and set-pin share issueMilerSession so the two success responses
  can't drift.

Also switches BookingPickupComplete's timestamp to DBNow() (IST) so the
compatibility-flow inwardedat matches the reconciliation windows.

Existing riders keep their PIN and are unaffected; blanking their password to
move them onto self-set is a separate, deliberate DB step.

go build, go vet and go test ./... all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WRaFH5hMRqmUQvVPQsyjZD

dto/admin.go

@@ -63,10 +63,14 @@ type VehicleCreateRequest struct {
 }
 
 type MilerCreateRequest struct {
-	Authname    string `json:"authname"`
-	Email       string `json:"email"`
-	Contactno   string `json:"contactno"`
-	Password    string `json:"password"`
+	Authname  string `json:"authname"`
+	Email     string `json:"email"`
+	Contactno string `json:"contactno"`
+	// No PIN field: riders never receive a console-set PIN. A rider is created
+	// with an empty Password and sets their own PIN on first login via
+	// /miler/set-pin (LoginMiler reports pin_set:false). Any "password" the
+	// console sends is ignored. This makes "riders choose their own PIN" a
+	// backend invariant instead of trusting the console not to send a default.
 	Displayname string `json:"displayname"`
 	// Tenantid attaches a rider to the client they deliver for — riders migrated
 	// from jupiter belong to a specific client (DailyGrubs, Bawa Medicals)

dto/auth.go

@@ -24,6 +24,16 @@ type MilerResetPinRequest struct {
 	Configid int    `json:"configid"`
 }
 
+// MilerSetPinRequest is the self-service first-login PIN creation payload
+// (SetMilerPin). DeviceToken is accepted so the rider is fully logged in the
+// moment they set their PIN, without a second verify-pin round trip.
+type MilerSetPinRequest struct {
+	Phone       string `json:"phone" xml:"phone" form:"phone"`
+	NewPin      string `json:"new_pin" xml:"new_pin" form:"new_pin"`
+	Configid    int    `json:"configid"`
+	DeviceToken string `json:"device_token"`
+}
+
 type AdminLoginRequest struct {
 	Email    string `json:"email" xml:"email" form:"email"`
 	Password string `json:"password" xml:"password" form:"password"`