Session expiry, arrival geofence guard, multi-destination stops

Three fixes found by running the app on a real handset against production.

1. An expired token left the app looking signed in and unable to work.
   MilerApi.onUnauthorized was declared and called on every 401 but never
   assigned, so the token was dropped and nothing else happened: the profile
   stayed on disk, logged_out stayed false, and the rider saw his own name over
   a dashboard whose every call returned 401. He reads that as "no work today".
   The teardown now lives in endSession() and both ways out of a session — the
   Log out button and the 401 path — use it.

2. Arrived was written locally even when the rider was not there.
   updateArrivedStatus answers false for three different things and the caller
   treated all of them as "the write did not land", which is only true of one.
   A geofence refusal and a server refusal now stop the rung and hand back the
   reason; a dead network still advances, as it should.

3. A multi-destination customer pickup collapsed onto one stop.
   GET /miler/bookings returns a row per destination once collected, all with
   the same bookingid and reference. Every local store keys on that id, so the
   accepted store deduped two of three drops away and their consignment ids
   were unrecoverable. orderid is now the stop key; bookingreference stays the
   booking's name. Cards show "Stop 2 of 3" and the receiver's own name and
   number rather than the sender's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EqVJPB9B4QuieZnBAAKgYQ

lib/views/offline/offline_banner.dart

@@ -25,10 +25,23 @@ import 'package:miler/views/helpers/constants/miler_type.dart';
 /// ── Why a strip is the right shape ──
 ///
 /// Everything the rider needs at the door was already fetched. Connectivity is
-/// needed to *report* the stop, not to work it. So the honest message is not
-/// "you are offline" but "keep going, this will sync" — and that is a line of
+/// needed to *report* the stop, not to work it. So the right shape is a line of
 /// text, not a screen.
 ///
+/// ── What it must not say ──
+///
+/// It said "Changes will sync when you're back online". **There is no mutation
+/// queue in this app** — no outbox, no replay, no retry loop. A status the
+/// rider sets with no signal is attempted once and fails, and nothing ever
+/// sends it again. The banner was promising a mechanism that does not exist,
+/// to the one person who would be blamed when the hub had no record of the
+/// stop.
+///
+/// The copy now says what is actually true: he can keep working the stop, and
+/// the *status* needs signal. Building the queue is a real piece of work and a
+/// separate one (see the release report); until it exists this line must not
+/// imply it.
+///
 /// The full-screen page survives for the one case where it is truthful: a cold
 /// start with no cached session, where there genuinely is nothing to show.
 ///
@@ -46,7 +59,7 @@ class OfflineBanner extends StatelessWidget {
   Widget build(BuildContext context) {
     return Semantics(
       liveRegion: true,
-      label: 'Offline. Your changes will sync when you are back online.',
+      label: 'Offline. Status updates need a connection. Stop details are still available.',
       excludeSemantics: true,
       child: Material(
         color: ColorConstants.warning,
@@ -64,9 +77,10 @@ class OfflineBanner extends StatelessWidget {
                 SizedBox(width: 9.w),
                 Expanded(
                   child: Text(
-                    // States what is true and what happens next. "You're
-                    // offline" alone tells a rider mid-stop nothing he can use.
-                    'Offline · Changes will sync when you’re back online',
+                    // States what is true and what he can still do. It must
+                    // not promise a sync — nothing in this app replays a failed
+                    // mutation. See the class note.
+                    'Offline · Status updates need a connection',
                     maxLines: 2,
                     overflow: TextOverflow.ellipsis,
                     style: MilerType.micro.on(ColorConstants.onAccent).semibold,