Harden admin moderation and ride request workflows

[SaarthurR]

Why

Admin report handling and ride pickup requests had workflow gaps at their trust boundaries: moderation evidence could be live or ambiguously selected, admin actions were not fully report-scoped/atomic, compact report layers could inherit a transformed containing block, and seat requests could bypass required pickup capture through direct inserts.

What changed

• Makes report evidence immutable, opt-in, bounded to history at or before the target, and reachable through generic admin notification deep links.
• Embeds newest-first moderation in desktop/mobile admin, keeps resolved reports read-only, and applies duration-based bans atomically with report resolution and audit state.
• Portals open report dialogs/sheets to document.body, preserving focus, dismissal, pending, and mobile behavior.
• Gates shared seat-request fields behind the existing dialog/sheet, requires pickup in both the Server Action and RPC, revokes direct authenticated passenger inserts, and keeps confirmed pickup/party details visible to drivers.

Migrations

Apply in order:

1. 20260713212211_admin_report_workflow.sql
2. 20260713212336_ride_pickup_request_hardening.sql
3. 20260713222740_report_history_upper_bound.sql

The repository SQL fixture covers privileges, immutable/bounded evidence, generic notifications, atomic ban/report state, required pickup, locking/capacity, and RPC-only passenger creation. Local Supabase pgTAP remains for CI/a Docker-enabled environment.

Test plan

Verified from a clean git archive of commit 63d5ddd using the existing dependencies/environment:

• npm test — 403 passed
• npm run lint
• npx tsc --noEmit
• npm run build — Next.js 16.2.9 Turbopack production build
• git diff --check origin/main..HEAD

Independent browser verification covered desktop 1440×900 and mobile 390×844 report-layer geometry, focus restoration, pending dismissal guards, exact target/context storage, admin default selection and notification deep links, with no app console or hydration-overlay errors. Ride browser smoke covered desktop/mobile intent layers, required pickup validation, and clean console/overlay behavior.

[vercel]

@SaarthurR is attempting to deploy a commit to the rankasaarth-7835's projects team on Vercel, but is not a member of this team. To resolve this issue, you can:

• Make your repository public. Collaboration is free for open source and public repositories.
• Upgrade to pro and add @SaarthurR as a member. A Pro subscription is required to access Vercel's collaborative features.
  • If you're the owner of the team, click here to upgrade and add @SaarthurR as a member.
  • If you're the user who initiated this build request, click here to request access.
  • If you're already a member of the rankasaarth-7835's projects team, make sure that your Vercel account is connected to your GitHub account.

To read more about collaboration on Vercel, click here.