feat(socket-auth): authenticate realtime socket with driver socket tokens

[roncodes]

What

Authenticates the driver app's realtime (SocketCluster) connection with a short-lived socket token, as part of authenticated realtime channels.

• Token provider (src/services/socket-auth.ts): POST {host}/{namespace}/socket/token with the driver's bearer token (same host/namespace the SDK adapter uses, default v1). Response {token, expires_in, expires_at}.
• In-memory auth engine passed to socketClusterClient.create: loadToken fetches a fresh token when there is none or it is within 60 s of expiry; saveToken / removeToken keep it in memory only. The token never touches MMKV/localStorage and never goes in the socket URL.
• Refresh at expires_in - 60 s via socket.authenticate(newToken) (expiry measured against the device clock from expires_in, so clock skew does not matter).
• Recovery: on deauthenticate or a channel kickOut, fetch a new token, re-authenticate and resubscribe every channel the app still listens to. subscribeFail on a tracked channel retries the same way with backoff (1 s, 2 s, 4 s), then gives up. Channels are tracked from the provider's subscribeChannel / closeChannel / killChannel.
• Session changes: the socket is recreated on login, logout (old socket disconnected, token dropped), organization switch, and instance-link reconfiguration. AuthContext exposes a sessionEpoch counter so an org switch re-authenticates even if the bearer token string does not change.
• Client tag: handshake query: { client: 'navigator/<app version>' } (version from DeviceInfo on native, package.json on web).
• Native and web contexts both updated.

Small fixes this needed:

• Native subscribeChannel used to wait forever when a subscription was rejected. It now settles on subscribe or subscribeFail. On a rejection it still returns the channel, so the retry delivers data to the same listener.
• OrderScreen now clears its listener ref on cleanup so it re-subscribes when the socket is recreated.

Why

Realtime channels are moving to authenticated subscriptions. With this change the driver app can only subscribe to channels the server authorizes for the signed-in driver.

Behaviour on older servers

The instance-link deep link can point this app at any self-hosted instance, including ones without socket auth. A 404 from the mint route (or no signed-in driver) means the socket connects anonymously, as it does today. The 404 is remembered for that socket session, so the app does not retry on every reconnect. Other mint failures (network, 5xx) also fall back to anonymous, with a 30 s retry backoff.

Test plan

• New jest tests in __tests__/SocketAuth-test.js cover the token request, the 404 and no-driver anonymous fallback, the 60 s expiry window, the refresh timer, deauthenticate/kickOut recovery and resubscribe, subscribeFail backoff, and teardown.
• Verified by CI / device QA.

Related PRs

Part of the authenticated realtime channels rollout (socket auth), one PR per repo:

• feat(socket-auth): authenticated realtime channels (tokens, authorizer, signed publish) core-api#290 — tokens, channel authorizer, signed HTTP publish (merge and tag first: fleetops and storefront require fleetbase/core-api ^1.6.69)
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel fleetops#358 — fleetops channel resolvers, driver socket tokens, per-customer tracking channel
• feat(socket-auth): storefront customer and checkout socket tokens, channel resolvers storefront#113 — customer and checkout socket tokens, storefront/checkout resolvers
• feat(socket-auth): Fleetbase socket server with JWT auth and signed internal publish fleetbase#704 — fleetbase/fleetbase-socket server, compose/helm/installer, console socket test page
• feat(socket-auth): authenticate the realtime socket with session socket tokens ember-core#97 — console socket service authenticates with session tokens
• feat(socket-auth): show channel authorization failures in the sockets viewer dev-engine#51 — sockets viewer shows authorization failures
• feat(socket-auth): authenticate realtime socket with driver socket tokens #112 — driver app socket tokens
• feat(socket-auth): authenticate realtime socket with customer and checkout socket tokens storefront-app#65 — customer and checkout socket tokens
• feat(socket-auth): generate the socket auth key on install fleetbase-cli#11 — installer generates the socket auth key
• feat(socket-auth): add socket.token() to mint realtime socket tokens fleetbase-js#45, feat(socket-auth): add customer.socketToken() for realtime channels storefront-js#22, feat(socket-auth): add socket->token() to mint realtime socket tokens fleetbase-php#28 — SDK socket token helpers
• fleetbase/fleetbase.io#120 — docs and migration guide