Session expiry, arrival geofence guard, multi-destination stops

Three fixes found by running the app on a real handset against production.

1. An expired token left the app looking signed in and unable to work.
   MilerApi.onUnauthorized was declared and called on every 401 but never
   assigned, so the token was dropped and nothing else happened: the profile
   stayed on disk, logged_out stayed false, and the rider saw his own name over
   a dashboard whose every call returned 401. He reads that as "no work today".
   The teardown now lives in endSession() and both ways out of a session — the
   Log out button and the 401 path — use it.

2. Arrived was written locally even when the rider was not there.
   updateArrivedStatus answers false for three different things and the caller
   treated all of them as "the write did not land", which is only true of one.
   A geofence refusal and a server refusal now stop the rung and hand back the
   reason; a dead network still advances, as it should.

3. A multi-destination customer pickup collapsed onto one stop.
   GET /miler/bookings returns a row per destination once collected, all with
   the same bookingid and reference. Every local store keys on that id, so the
   accepted store deduped two of three drops away and their consignment ids
   were unrecoverable. orderid is now the stop key; bookingreference stays the
   booking's name. Cards show "Stop 2 of 3" and the receiver's own name and
   number rather than the sender's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EqVJPB9B4QuieZnBAAKgYQ

test/delivery_leg_test.dart

@@ -27,22 +27,39 @@ void main() {
 
   tearDown(() => ServiceProfile.setActive(ServiceProfile.parcel));
 
-  group('the three outcomes', () {
-    test('are exactly delivered, skip and cancelled', () {
+  group('the four ways a stop in custody can end', () {
+    test('are delivered, skip, cancelled and handed over', () {
+      // ── `handedOver` was added 2026-09-16 ──
+      //
+      // There used to be three, and the missing fourth is why a base-routed
+      // parcel could not be closed at all: `MilerApi.inwardAtHub` existed, was
+      // documented and was covered by `hub_handover_contract_test.dart`, and
+      // had no call site. A rider carrying a Gandhipuram → Chennai consignment
+      // was told "hand it over at base" by `releaseForDelivery` and given no
+      // control that would record him doing so.
+      //
+      // It is deliberately NOT a kind of `delivered`: a base handover has no
+      // receiver, no proof photo, no OTP and no COD, and it must never reach
+      // `deliver` — that route moves the consignment to `Out_for_Delivery`
+      // against a receiver in another district, which the handset cannot undo.
       expect(DeliveryOutcome.values.map((o) => o.label), [
         'Delivered',
         'Skip',
         'Cancelled',
+        'Handed over',
       ]);
     });
 
     test('delivered is the only one that completes the order', () {
       // Skip is a return visit — it increments `attemptcount` rather than
-      // failing the parcel — and cancelled is a withdrawal. Neither is a
-      // delivery, and Activity must not file them as one.
+      // failing the parcel — and cancelled is a withdrawal. Handed over ends
+      // this RIDER's custody while the parcel's own journey carries on inside
+      // the network. None of the three is a delivery, and Activity must not
+      // file them as one.
       expect(DeliveryOutcome.delivered.pastTense, 'Delivered');
       expect(DeliveryOutcome.skipped.pastTense, 'Skipped');
       expect(DeliveryOutcome.cancelled.pastTense, 'Cancelled');
+      expect(DeliveryOutcome.handedOver.pastTense, 'Handed over');
     });
 
     test('each one is coloured by what it means, not by where it sits', () {