Miler rider app: surface system, visible design language, backend lifecycle

Design system
- MilerSurface ladder (canvas → working → raised → floating) with MilerPanel
  as layer 1; canvas moved to #DEE3EA so white separates at 1.290:1.
- Visible vocabulary applied across Home, Deliveries, Activity, Account and
  the sheets: hero heads (tabular numeral + small caption, clamped at 1.3x),
  canvas wells for anything that opens, small filled tags for shelf labels,
  demoted placeholders. Recorded in DESIGN_SYSTEM.md §6.
- One icon family: 222 Material glyphs migrated to Lucide; none left outside
  lib/xpress.
- Colour semantics corrected: amber only for what is genuinely owed, brand red
  reserved for the live stop, disabled primaries go neutral rather than pale.

Data and lifecycle
- lib/data/lifecycle.dart reads mutations for what they prove; route_order.dart
  makes admin sequence the single ordering authority; service_day.dart, and
  stop_area.dart rewritten against live Coimbatore addresses (digit-token
  stripping, city stoplist, street suffixes, stammer collapse).
- countLabel states the load once, in bags.

Testing
- 1440 tests passing; golden shot harnesses for Home, Deliveries, Activity,
  sheets and verify, with test/failures/ now gitignored (diff debris).
- New pins: home_gutter_test, stop_area_test, plus updated structural bounds.

Note: this commit also carries pre-existing working-tree deletions that were
present before this work (API_SPEC.md, README.md, demo test fixtures).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/no_embedded_secrets_test.dart

@@ -0,0 +1,57 @@
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+
+/// ─────────────────────────────────────────────────────────────────────────
+/// NO CREDENTIAL MAY BE A LITERAL IN THE BINARY
+///
+/// Three files carried a DigitalOcean Spaces access key and secret key as
+/// `const String` literals, compiled into every APK the app has shipped.
+/// Anyone with the binary could read them with `strings`, and the pair was
+/// read-write on the whole `doormile` bucket — every rider's proof photo, for
+/// every tenant, readable and deletable by anybody who had installed the app
+/// once.
+///
+/// They come from `--dart-define` now. This is the guard that stops the next
+/// one going in, because the failure is silent: the code works perfectly with a
+/// literal, and nothing about it looks wrong in review.
+///
+/// **This test does not undo the exposure.** The pair is in this repository's
+/// history and has been distributed; it has to be rotated, and the upload
+/// belongs behind a server-issued signed URL.
+/// ─────────────────────────────────────────────────────────────────────────
+void main() {
+  test('no source file assigns a credential-shaped literal', () {
+    // Names that mean "this is a secret", assigned a quoted literal of any
+    // length that is not obviously empty.
+    final assignment = RegExp(
+      r'''(accessKey|secretKey|apiKey|apiSecret|password|privateKey|'''
+      r'''clientSecret|authToken)\s*=\s*["'][^"']{8,}["']''',
+      caseSensitive: false,
+    );
+
+    final offenders = <String>[];
+    for (final entity in Directory('lib').listSync(recursive: true)) {
+      if (entity is! File || !entity.path.endsWith('.dart')) continue;
+      final lines = entity.readAsLinesSync();
+      for (var i = 0; i < lines.length; i++) {
+        final code = lines[i].trim();
+        if (code.startsWith('//') || code.startsWith('///')) continue;
+        // `String.fromEnvironment('SPACES_KEY')` is the fix, not the fault.
+        if (code.contains('fromEnvironment')) continue;
+        if (assignment.hasMatch(code)) {
+          offenders.add('${entity.path}:${i + 1}');
+        }
+      }
+    }
+
+    expect(
+      offenders,
+      isEmpty,
+      reason:
+          'a credential compiled into the app is readable by anyone who '
+          'installs it — pass it with --dart-define and rotate anything that '
+          'has already shipped',
+    );
+  });
+}