Communication center, chat, interactive map, distance pricing & demo trips

[llfzzz]

Summary

Removes login verification codes from the Message Center and turns it into a real user communication center, adds passenger–driver chat, an interactive map with a working geolocation flow, distance-based pricing, and demo virtual-trip generation — while preserving every existing security/architecture invariant (gateway-only access, server-authoritative prices/roles/state, demo isolation, idempotency, replay protection, audit logging).

1. Login codes out of the Message Center

• Demo login code now lives only on the login page via a challenge-bound DemoLoginCodeStore in auth-service. POST /api/auth/sms-code returns an opaque challengeId; POST /api/auth/sms-code/demo-peek {phone, challengeId} returns the code only on an exact match. Plaintext is deleted on successful login, on lockout, and by TTL; never logged, never an inbox/notification record.
• Secure code lifecycle kept: hashed single-use storage, TTL, per-phone issue + peek rate limits, verify-attempt lockout, replay rejection.
• notification-service V2 purges historical AUTH_SMS_CODE deliveries; notify rejects the category (CATEGORY_NOT_INBOXABLE); inbox queries exclude it defensively.

2. Production Message Center (/api/inbox)

• Pagination (keyset), unread count, mark one / mark all read, category filter, timestamps, empty states, deep links to order/trip/payment/conversation, masked preview + explicit owner/TTL-scoped audited reveal. Mobile + desktop. Demo inbox removed.
• Fan-out from domain events: transactional notification outbox in order-service (relayed with event_id as the receiver dedupe key) at every state transition; best-effort driver-verification notices; trip-service departure-reminder @Scheduled scan. Shared NotificationCategory enum.

3. Passenger–driver chat

• Conversation bound to a legitimate order, hosted inside notification-service (no 15th JVM). Participants derived server-side from order + trip records; non-participants get 404 on every endpoint (discovery-proof). Idempotent send via clientMsgId, per-participant read cursors, send/create rate limits, 1–500 char validation, 5s polling. Mobile + desktop chat window and conversation list; "联系司机/乘客" entries on order cards.

4–5. Interactive map + geolocation

• Shared zustand route-selection state across both shells + thumbnail + expanded map; zoom/pan/touch, locate + accuracy circle, draggable markers, click-to-pick, POI search, swap/clear, route + price confirmation. AMap for tiles/interaction only; all resolution/routing/pricing stays server-side. Geolocation gains secure-context + permission preflight and a poor-accuracy correction flow; no IP fallback.

6. Distance-based pricing

• fare = max(minFare, baseFare + max(0, distanceKm − includedKm) × extraPerKm), BigDecimal only, documented rounding. Components stored per trip so the displayed breakdown always matches the stored price. New POST /api/trips/route-preview returns {route, PriceBreakdown} (single pricing authority); rendered verbatim in booking UIs.

7. Demo virtual trips

• Demo-gated (app.demo.virtual-trips-enabled, fenced by DemoModeGuard), deterministic seeded generation, strictly formula-derived prices, synthetic non-authenticatable drivers, source='DEMO' label, delete-then-insert cap + expiry cleanup, random route via an unrouted map-service demo-places endpoint.

Migrations

• notification: V2 purge, V3 inbox links/dedupe, V4 chat tables
• order: V5 notification outbox
• trip: V6 departure reminder, V7 pricing breakdown, V8 source

Verification

• ./scripts/verify.sh green — backend BUILD SUCCESS (all 15 modules), frontend typecheck + build (user-h5 + admin-console)
• Playwright 15 passed (13 existing + 2 new expanded-map specs)
• Not yet run in this environment: full-stack scripts/demo-smoke.sh (needs the local Docker stack) and staging SSE load test.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.