P1 complete: real انطلق maps + Nabeh WhatsApp OTP + chat + ratings + cancel(both) + fraud detection

- maps: real map-saas route/geocode/reverse/places (x-api-key per country) + straight-line fallback
- auth: Redis-backed OTP + Nabeh WhatsApp send (dev mode keeps fixed 1234 bypass)
- chat: per-trip messages (participant-guarded) + socket broadcast
- ratings: post-trip rating + driver avg recompute + no double-rate
- cancel: from rider or driver + stage-based cancel fee + notify both
- fraud: cancel-abuse (soft/hard block via Redis), arrived-far-from-pickup, completed-too-fast → fraud_flags
- migration InitP1b (chat_messages, ratings, fraud_flags, trips.cancelled_by/cancel_fee)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.env.example

@@ -27,6 +27,19 @@ JWT_SECRET=change_me_jwt_secret
 JWT_EXPIRES=15m
 JWT_REFRESH_EXPIRES=30d
 
-# ---- Maps (انطلق) ----
+# ---- Maps (انطلق / map-saas) ----
 MAPS_TILES_URL=http://martin:3000
 MAPS_PROVIDER=antlaq
+MAPS_BASE_URL=https://map-saas.intaleqapp.com
+# مفاتيح انطلق لكل دولة (ضع القيم الحقيقية في .env على السيرفر — لا تُرفع لـ git)
+MAPS_API_KEY_JO=
+MAPS_API_KEY_SY=
+MAPS_PLACES_API_KEY=
+
+# ---- OTP via Nabeh (WhatsApp) ----
+# اتركه dev لتفعيل الرمز الثابت 1234 بلا إرسال؛ اجعله false للإرسال الحقيقي عبر Nabeh
+OTP_DEV_MODE=true
+NABEH_BASE_URL=https://nabeh.intaleqapp.com
+NABEH_EMAIL=
+NABEH_PASSWORD=
+NABEH_OTP_TYPE=text