fix: console tenant scoping, miler identity spoofing, delivery proof, timezone

Security
- Express console had no tenant scoping at all: LoginAdmin hardcoded tenantid 0
  into every JWT and none of the 85 admin handlers filtered by tenant, so any
  client given a console login would read every other client's bookings,
  customers, pricing and reports. Adds DoormileAuth.Tenantid (nil = Doormile
  staff, unrestricted; set = client, scoped), emits it in the token, and scopes
  reads, guards writes and pins tenantid on create.
- Miler telemetry (/miler/logs, /miler/status, /miler/consignments/logs) took
  userid from the request body, letting any authenticated rider write another
  rider's status and GPS trail — data the dispatch layer reasons over. Identity
  now comes from the token.
- POST /miler/reset-pin was unauthenticated and overwrote a PIN given only a
  phone number, so reset-pin + verify-pin took over any rider account. Now
  requires admin/manager/executive auth.

Correctness
- Date ranges compared the container's UTC clock against timestamps the DB
  writes as IST wall-clock (DSN sets TimeZone=Asia/Kolkata), so "today so far"
  ended 5h30m in the past and silently dropped everything created after noon
  IST from every report. Sets TZ in the image and adds utils.DBNow/DBToday,
  which stay correct regardless of container timezone.
- CreateMiler never set Configid, so console-created riders got the column
  default of 1 while LoginMiler looks up configid 1001 — every such rider was
  unable to log in, reported as "no miler account found".
- Delivery wrote no consignment history row, so a tracking timeline never
  showed the parcel arriving.

Features
- Delivery OTP is now real (crypto/rand, issued to the receiver, verified and
  cleared on delivery) but opt-in per client via Tenant.Requiredeliveryotp,
  defaulting off — friction worth it for a courier parcel, not a food order.
- Express bookings accept pickuplocationid, so the console can name a client
  site (a DailyGrubs kitchen) instead of retyping its address; validated
  against the tenant and carried through to the consignment.
- TenantLocation.Locationname, miler tenantid/hubid, Nagercoil (629) opened.
- PUT /miler/availability accepts both "status" and "availabilitystatus", and
  /miler/location no longer drops speed/heading — both were contract
  mismatches against the doc the Flutter dev was given.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

models/audit.go

@@ -57,9 +57,9 @@ type Consignment struct {
 	Chargeableweight    float64    `json:"chargeableweight" gorm:"column:chargeableweight;not null"`
 	Codamount           float64    `json:"codamount" gorm:"column:codamount;default:0.00"`
 	Codcollected        float64    `json:"codcollected" gorm:"column:codcollected;default:0.00"`
-	Paymentmode         string     `json:"paymentmode" gorm:"column:paymentmode"`         // Prepaid, COD, To_Pay
+	Paymentmode         string     `json:"paymentmode" gorm:"column:paymentmode"`                      // Prepaid, COD, To_Pay
 	Billingstatus       string     `json:"billingstatus" gorm:"column:billingstatus;default:Unbilled"` // Unbilled, Billed, Paid, Settled
-	Status              string     `json:"status" gorm:"column:status;default:Created"`   // Created, Inwarded_at_Hub, Tripsheet_Loaded, In_Transit, Out_for_Delivery, Delivered, RTO_Initiated, Returned_to_Sender, Missing, Damaged
+	Status              string     `json:"status" gorm:"column:status;default:Created"`                // Created, Inwarded_at_Hub, Tripsheet_Loaded, In_Transit, Out_for_Delivery, Delivered, RTO_Initiated, Returned_to_Sender, Missing, Damaged
 	Attemptcount        int        `json:"attemptcount" gorm:"column:attemptcount;default:0"`
 	Estimateddeliveryat *time.Time `json:"estimateddeliveryat" gorm:"column:estimateddeliveryat"`
 	Sladueat            *time.Time `json:"sladueat" gorm:"column:sladueat"`
@@ -69,11 +69,16 @@ type Consignment struct {
 	Parentconsignmentid *int       `json:"parentconsignmentid" gorm:"column:parentconsignmentid"`
 	Condition           string     `json:"condition" gorm:"column:condition;size:50"` // recorded at hub inbound scan: Good, Damaged, etc.
 	Shelf               string     `json:"shelf" gorm:"column:shelf;size:50"`         // hub storage location assigned at inbound scan
-	Createdat           time.Time  `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
-	Updatedat           time.Time  `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
-	Createdby           int        `json:"createdby" gorm:"column:createdby"`
-	Updatedby           int        `json:"updatedby" gorm:"column:updatedby"`
-	Deletedat           *time.Time `json:"deletedat,omitempty" gorm:"column:deletedat"`
+	// Deliveryotp is issued when the consignment goes out for delivery and is
+	// given to the receiver, not the rider — it is the only proof the parcel
+	// reached the right person. Never serialised outward: returning it in an API
+	// response would hand the rider the code they are supposed to be told.
+	Deliveryotp string     `json:"-" gorm:"column:deliveryotp;size:6"`
+	Createdat   time.Time  `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
+	Updatedat   time.Time  `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
+	Createdby   int        `json:"createdby" gorm:"column:createdby"`
+	Updatedby   int        `json:"updatedby" gorm:"column:updatedby"`
+	Deletedat   *time.Time `json:"deletedat,omitempty" gorm:"column:deletedat"`
 }
 
 func (Consignment) TableName() string {
@@ -121,12 +126,12 @@ func (ConsignmentException) TableName() string {
 // at that hub. One conversation per (hubid, mileruserid) pair.
 type HubConversation struct {
 	Hubconversationid int       `json:"hubconversationid" gorm:"primaryKey;column:hubconversationid"`
-	Hubid              int       `json:"hubid" gorm:"column:hubid;index;not null"`
-	Mileruserid        *int      `json:"mileruserid" gorm:"column:mileruserid;index"`
-	Participantname    string    `json:"participantname" gorm:"column:participantname;not null"`
-	Participantrole    string    `json:"participantrole" gorm:"column:participantrole"`
-	Createdat          time.Time `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
-	Updatedat          time.Time `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
+	Hubid             int       `json:"hubid" gorm:"column:hubid;index;not null"`
+	Mileruserid       *int      `json:"mileruserid" gorm:"column:mileruserid;index"`
+	Participantname   string    `json:"participantname" gorm:"column:participantname;not null"`
+	Participantrole   string    `json:"participantrole" gorm:"column:participantrole"`
+	Createdat         time.Time `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
+	Updatedat         time.Time `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
 }
 
 func (HubConversation) TableName() string {
@@ -137,13 +142,13 @@ func (HubConversation) TableName() string {
 // requesting hub staff) or "them" (the other party), matching the hub
 // console frontend's bubble-side convention.
 type HubMessage struct {
-	Hubmessageid       int       `json:"hubmessageid" gorm:"primaryKey;column:hubmessageid"`
-	Hubconversationid  int       `json:"hubconversationid" gorm:"column:hubconversationid;index;not null"`
-	Sender             string    `json:"sender" gorm:"column:sender;not null"` // me, them
-	Senderstaffid      *int      `json:"senderstaffid" gorm:"column:senderstaffid"`
-	Messagetext        string    `json:"messagetext" gorm:"column:messagetext;not null"`
-	Isread             bool      `json:"isread" gorm:"column:isread;default:false"`
-	Createdat          time.Time `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
+	Hubmessageid      int       `json:"hubmessageid" gorm:"primaryKey;column:hubmessageid"`
+	Hubconversationid int       `json:"hubconversationid" gorm:"column:hubconversationid;index;not null"`
+	Sender            string    `json:"sender" gorm:"column:sender;not null"` // me, them
+	Senderstaffid     *int      `json:"senderstaffid" gorm:"column:senderstaffid"`
+	Messagetext       string    `json:"messagetext" gorm:"column:messagetext;not null"`
+	Isread            bool      `json:"isread" gorm:"column:isread;default:false"`
+	Createdat         time.Time `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
 }
 
 func (HubMessage) TableName() string {