Session expiry, arrival geofence guard, multi-destination stops

Three fixes found by running the app on a real handset against production.

1. An expired token left the app looking signed in and unable to work.
   MilerApi.onUnauthorized was declared and called on every 401 but never
   assigned, so the token was dropped and nothing else happened: the profile
   stayed on disk, logged_out stayed false, and the rider saw his own name over
   a dashboard whose every call returned 401. He reads that as "no work today".
   The teardown now lives in endSession() and both ways out of a session — the
   Log out button and the 401 path — use it.

2. Arrived was written locally even when the rider was not there.
   updateArrivedStatus answers false for three different things and the caller
   treated all of them as "the write did not land", which is only true of one.
   A geofence refusal and a server refusal now stop the rung and hand back the
   reason; a dead network still advances, as it should.

3. A multi-destination customer pickup collapsed onto one stop.
   GET /miler/bookings returns a row per destination once collected, all with
   the same bookingid and reference. Every local store keys on that id, so the
   accepted store deduped two of three drops away and their consignment ids
   were unrecoverable. orderid is now the stop key; bookingreference stays the
   booking's name. Cards show "Stop 2 of 3" and the receiver's own name and
   number rather than the sender's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EqVJPB9B4QuieZnBAAKgYQ

lib/data/work_scope.dart

@@ -42,13 +42,8 @@ import 'package:miler/data/service_profile.dart';
 class WorkScope {
   final int userId;
   final int tenantId;
-  final ServiceLine line;
 
-  const WorkScope({
-    required this.userId,
-    required this.tenantId,
-    required this.line,
-  });
+  const WorkScope({required this.userId, required this.tenantId});
 
   /// The scope of the session running right now.
   ///
@@ -65,26 +60,17 @@ class WorkScope {
           ? raw
           : int.tryParse(raw?.toString() ?? '') ?? 0;
       final tenantId = await ApiConfig.storedTenantId();
-      return WorkScope(
-        userId: userId,
-        tenantId: tenantId,
-        line: ServiceProfile.active.line,
-      );
+      return WorkScope(userId: userId, tenantId: tenantId);
     } catch (e) {
       debugPrint('[SCOPE] could not resolve the session scope: $e');
-      return WorkScope(
-        userId: 0,
-        tenantId: 0,
-        line: ServiceProfile.active.line,
-      );
+      return const WorkScope(userId: 0, tenantId: 0);
     }
   }
 
   /// A signed-out or unreadable session. Deliberately still a real scope
   /// rather than null: code paths that run before login write to their own
   /// drawer instead of into the last rider's.
-  static WorkScope get anonymous =>
-      WorkScope(userId: 0, tenantId: 0, line: ServiceProfile.active.line);
+  static WorkScope get anonymous => const WorkScope(userId: 0, tenantId: 0);
 
   /// The suffix that turns a store key into this scope's key.
   ///
@@ -93,11 +79,36 @@ class WorkScope {
   /// All three parts are in it because all three can change independently: a
   /// rider can move tenant, a tenant can run either line, and one device can
   /// see several riders.
-  String get key => 'u$userId.t$tenantId.${line.name}';
+  String get key => 'u$userId.t$tenantId';
 
   /// Scopes a legacy global key.
   String scoped(String baseKey) => '$baseKey::$key';
 
+  /// The keys this scope's records used to live under, newest convention first.
+  ///
+  /// ── Why the line came out of the key ──
+  ///
+  /// The key used to carry a third part, the rider's service line:
+  /// `completed_bookings::u38.t13.milkMan`. That was right while a rider was
+  /// one thing for the life of his account. He is not: one Miler carries meal
+  /// parcels, logistics collections and customer pickups in the same shift, and
+  /// keying his records by a line splits one day's work across two drawers —
+  /// with whichever drawer the app resolved into today being the only one he
+  /// can see. Work he finished an hour ago disappears because a label changed.
+  ///
+  /// Rider and tenant still scope it. Those are facts about *who* stored the
+  /// record, which is what ownership means. The line was a fact about *what he
+  /// was doing*, which belongs on the work item, not on the drawer.
+  ///
+  /// Every historical spelling is listed so a rider upgrading mid-shift keeps
+  /// what he has already done.
+  Iterable<String> legacyScopedKeys(String baseKey) sync* {
+    for (final line in ServiceLine.values) {
+      yield '$baseKey::u$userId.t$tenantId.${line.name}';
+    }
+  }
+
+
   /// Does [record] provably belong to this scope?
   ///
   /// Used on rows that were written before scoping existed, and as a
@@ -127,12 +138,9 @@ class WorkScope {
       'scopeuserid',
     ]);
     final rowTenant = intOf(const ['tenantid', 'TenantId', 'scopetenantid']);
-    final rowLine = (record['scopeline'] ?? '').toString();
-
-    if (rowUser == 0 && rowTenant == 0 && rowLine.isEmpty) return false;
+    if (rowUser == 0 && rowTenant == 0) return false;
     if (rowUser != 0 && rowUser != userId) return false;
     if (rowTenant != 0 && rowTenant != tenantId) return false;
-    if (rowLine.isNotEmpty && rowLine != line.name) return false;
     return true;
   }
 
@@ -168,11 +176,8 @@ class WorkScope {
       'scopeuserid',
     ]);
     final rowTenant = intOf(const ['tenantid', 'TenantId', 'scopetenantid']);
-    final rowLine = (record['scopeline'] ?? '').toString();
-
     if (rowUser != 0 && userId != 0 && rowUser != userId) return true;
     if (rowTenant != 0 && tenantId != 0 && rowTenant != tenantId) return true;
-    if (rowLine.isNotEmpty && rowLine != line.name) return true;
     return false;
   }
 
@@ -184,18 +189,16 @@ class WorkScope {
     ...record,
     'scopeuserid': userId,
     'scopetenantid': tenantId,
-    'scopeline': line.name,
   };
 
   @override
   bool operator ==(Object other) =>
       other is WorkScope &&
       other.userId == userId &&
-      other.tenantId == tenantId &&
-      other.line == line;
+      other.tenantId == tenantId;
 
   @override
-  int get hashCode => Object.hash(userId, tenantId, line);
+  int get hashCode => Object.hash(userId, tenantId);
 
   @override
   String toString() => 'WorkScope($key)';