feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel

[roncodes]

What

FleetOps part of realtime socket authentication.

• Channel resolvers. Every FleetOps channel prefix is registered with core-api's SocketChannelRegistry: order, driver, driverAssigned, vehicle, trailer, device, waypoint, entity, place, contact, fleet, zone, service_area, service_rate, service_quote, purchase_rate, tracking_status, tracking_number, payload (generic model resolver), customer, vendor, facilitator (morph prefixes), position (uuid only; positions have no public id) and tracking (always denied).
  • Console users and API credentials: records of their own company.
  • Drivers: their own driver record, their current vehicle and its devices and positions, and orders assigned to them (directly or through one of the order's payload entities).
  • Customers: orders where they are the customer, plus the driver and vehicle of their active orders (not completed or canceled).
• Driver socket tokens. A principal resolver claims Sanctum users who drive for the current company on v1/socket/token. The resulting driver principal has sub = driver uuid and ids = driver uuid and public id plus user uuid and public id.
• Replay hardening. When socket auth is enabled, positions/replay only accepts a channel_id that the requesting user could subscribe to (checked through ChannelAuthorizer). Any other channel gets a 403. When socket auth is off, the endpoint behaves exactly as before.
• Public tracking channel (per customer).
  • TrackingScope covers one customer of one order. A stop belongs to the waypoint's customer, else to the order's customer.
  • TrackingChannel gives tracking.{opaque} and the scoped token, both through core-api SocketToken::trackingId() and SocketToken::forTracking().
  • TrackingUpdate builds the sanitized payload. It holds only the viewer's stops (status, ETA, timeline status/code/time with no free-text details) and whole-route counts. For the driver it holds the first name, the vehicle label and the online flag, with no photo or phone. The vehicle position is rounded to 4 decimals and comes with heading and seen_at. Driver and position are included only while the order is en route and the viewer still has an incomplete stop.
  • TrackingPublisher and the PublishTrackingUpdate job publish when order status, assignment or ETA changes, on waypoint/entity activity, and on driver or vehicle positions. The hooks do nothing while socket auth is off. Position lookups are throttled to once per 5 s per driver/vehicle and per order, and ETAs are refreshed at most once a minute.
• Console scheduler. The scheduler no longer subscribes to the dead company.{id}.orders channel. Its teardown closes only the driver channels it opened; before, it closed every channel, chat included.

Why

Without these resolvers, enabling socket authentication would deny every FleetOps channel. With them, drivers and customers only see their own data.

Dependency

Requires fleetbase/core-api ^1.6.69 (raised in composer.json). CI on this PR needs that core-api release, so composer install fails until it is tagged.

Test plan

Verified by CI. New Pest tests cover:

• each resolver across two companies
• driver and customer narrow allow/deny
• the driver principal resolver
• replay channel rejection
• tracking channel determinism and per-customer separation
• payload sanitization
• location publish gating and throttling, the job and the listener

There is also an Ember unit test for the scheduler teardown.

Related PRs

Part of the authenticated realtime channels rollout (socket auth), one PR per repo:

• feat(socket-auth): authenticated realtime channels (tokens, authorizer, signed publish) core-api#290 — tokens, channel authorizer, signed HTTP publish (merge and tag first: fleetops and storefront require fleetbase/core-api ^1.6.69)
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel #358 — fleetops channel resolvers, driver socket tokens, per-customer tracking channel
• feat(socket-auth): storefront customer and checkout socket tokens, channel resolvers storefront#113 — customer and checkout socket tokens, storefront/checkout resolvers
• feat(socket-auth): Fleetbase socket server with JWT auth and signed internal publish fleetbase#704 — fleetbase/fleetbase-socket server, compose/helm/installer, console socket test page
• feat(socket-auth): authenticate the realtime socket with session socket tokens ember-core#97 — console socket service authenticates with session tokens
• feat(socket-auth): show channel authorization failures in the sockets viewer dev-engine#51 — sockets viewer shows authorization failures
• feat(socket-auth): authenticate realtime socket with driver socket tokens navigator-app#112 — driver app socket tokens
• feat(socket-auth): authenticate realtime socket with customer and checkout socket tokens storefront-app#65 — customer and checkout socket tokens
• feat(socket-auth): generate the socket auth key on install fleetbase-cli#11 — installer generates the socket auth key
• feat(socket-auth): add socket.token() to mint realtime socket tokens fleetbase-js#45, feat(socket-auth): add customer.socketToken() for realtime channels storefront-js#22, feat(socket-auth): add socket->token() to mint realtime socket tokens fleetbase-php#28 — SDK socket token helpers
• docs(socket-auth): authenticated realtime channels and migration guide fleetbase.io#120 — docs and migration guide