Phase 4 §1/§5: notif banner detection on API <33 + chat-delivery WS→FCM lifecycle

§1 notif banner: permission_handler v11 returns granted unconditionally
for Permission.notification on Android <13 because POST_NOTIFICATIONS
didn't exist as a runtime permission. Result: SHome1st amber "notifikasi
off" banner never showed on API 24-32 even when the user toggled
notifications off in Settings → Apps. Add a
NotificationManagerCompat.areNotificationsEnabled() pre-check via
flutter_local_notifications (works from API 19+) so the banner reflects
the real OS state on older Android.

§5 chat delivery: the contract is "WS when foreground, FCM when
background", but the previous build only honoured (1) — Android keeps
the TCP socket alive after the Dart isolate is paused, so backend's
`socket.readyState === 1` check returned true and FCM never fired.
Fix has five parts (all required together):

 1. Customer-side lifecycle observer in client_app/main.dart closes
    chatProvider's WS on paused/detached, reconnects on resumed.
 2. `_appPaused` gate in main.dart suppresses the activeSessionProvider
    listener's auto-reconnect (15s poll in active_session_notifier
    would otherwise re-open the WS the next tick after the observer
    closed it — defeating the fallback).
 3. Mitra-side lifecycle observer in mitra_app/main.dart stashes
    `_pausedChatSessionId`, calls mitraChatProvider.disconnect(), and
    re-issues connect(saved) on resumed.
 4. MitraChat gains a `_connectedSessionId` field + getter so the
    observer in step 3 can read it back across disconnect (disconnect
    clears it; the next connect overwrites it).
 5. SearchingScreen resets pairingProvider when entering with a new
    draft.paymentId — previously it retained PairingActiveData with
    the *old* sessionId after a session ended, and the next pairing
    flow navigated straight to that completed session showing
    "Sesi sudah berakhir".

Backend additions under /internal/_test/* for assertion harness:
inspectSessionWsState + GET /ws-connection-state,
POST /send-chat-message-as-mitra (with delivered_via),
POST /send-chat-message-as-customer (with delivered_via),
POST /send-fcm-chat-message (raw FCM dispatch).

Maestro coverage:
 - ts-customer-05-01: mitra → customer message when customer is
   backgrounded → delivered_via=fcm.
 - ts-customer-05-02: customer → mitra message when mitra is
   backgrounded → delivered_via=fcm.
 - ts-customer-01-01: §1 notif-denied banner on home. Documented
   precondition: mitra must be force-stopped or backgrounded on the
   chat screen before 05-02 runs (Maestro can only drive one --udid
   per run; mitra-side lifecycle observer end-to-end is deferred).

Helper scripts under client_app/.maestro/scripts/:
inspect_ws_state.js, assert_ws_state.js,
send_chat_message_as_mitra.js, assert_delivered_via.js (takes
SENDER=mitra|customer to route to the matching backend endpoint).

README_section_05.md documents the test plan, helper scripts, and the
deferred mitra-side maestro driving. Both apps tested manually on
API 28 AVDs where FCM delivery is sub-second; API 24 has 5-30 min
heartbeats that make it impractical for FCM-related testing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/lib/core/notifications/notif_permission.dart

@@ -1,7 +1,9 @@
 import 'dart:async';
+import 'dart:io' show Platform;
 
 import 'package:firebase_messaging/firebase_messaging.dart';
 import 'package:flutter/widgets.dart';
+import 'package:flutter_local_notifications/flutter_local_notifications.dart';
 import 'package:permission_handler/permission_handler.dart' as ph;
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
@@ -14,11 +16,29 @@ enum NotifPermStatus { notDetermined, granted, denied }
 ///   - iOS uses Firebase Messaging (which surfaces the system UNNotification
 ///     authorization status).
 ///   - Android 13+ uses `permission_handler` for `Permission.notification`
-///     (POST_NOTIFICATIONS runtime). Older Android always reports granted.
+///     (POST_NOTIFICATIONS runtime).
+///   - Android <13: POST_NOTIFICATIONS doesn't exist as a runtime permission,
+///     so `permission_handler` returns `granted` regardless of the user's
+///     Settings → Apps → Notifications toggle. We add a
+///     `NotificationManagerCompat.areNotificationsEnabled()` pre-check via
+///     `flutter_local_notifications` to honour that user-facing toggle on
+///     older Android.
 class NotifPermission {
   const NotifPermission();
 
   Future<NotifPermStatus> readStatus() async {
+    // Older Android: permission_handler can't see the
+    // Settings → Apps → Notifications toggle, so we ask the local-notifs
+    // plugin (backed by NotificationManagerCompat.areNotificationsEnabled,
+    // which works from API 19). If disabled there, surface it as `denied`
+    // so the SHome1st banner reflects reality on API 24-32.
+    if (Platform.isAndroid) {
+      final androidImpl = FlutterLocalNotificationsPlugin()
+          .resolvePlatformSpecificImplementation<
+              AndroidFlutterLocalNotificationsPlugin>();
+      final enabled = await androidImpl?.areNotificationsEnabled();
+      if (enabled == false) return NotifPermStatus.denied;
+    }
     final phStatus = await ph.Permission.notification.status;
     return _mapPh(phStatus);
   }

client_app/lib/features/chat/screens/searching_screen.dart

@@ -50,9 +50,22 @@ class _SearchingScreenState extends ConsumerState<SearchingScreen> {
       // "Curhat lagi" flow stamped the targeted mitra onto the draft before
       // payment, so we fire the targeted request and bounce to the dedicated
       // wait overlay; everything else is a general blast.
-      final state = ref.read(pairingProvider);
+      //
+      // Carry-over guard: if a previous chat session ended, pairingProvider
+      // retains its terminal state (PairingActiveData with the *old*
+      // sessionId, PairingFailed, PairingCancelled, etc). Without resetting
+      // here, the `state is PairingInitialData` branch wouldn't fire and
+      // `_onPairingState` below would re-emit a stale PairingActiveData →
+      // /chat/session/<old_sessionId>, dropping the customer on a chat
+      // screen for a `completed` session ("Sesi sudah berakhir"). Reset to
+      // Initial whenever we have a fresh payment to consume.
+      final draft = ref.read(paymentDraftNotifierProvider);
+      var state = ref.read(pairingProvider);
+      if (state is! PairingInitialData && draft.paymentId != null) {
+        ref.read(pairingProvider.notifier).reset();
+        state = ref.read(pairingProvider);
+      }
       if (state is PairingInitialData) {
-        final draft = ref.read(paymentDraftNotifierProvider);
         if (draft.paymentId != null) {
           if (draft.targetedMitraId != null) {
             // ignore: discarded_futures

client_app/lib/main.dart

@@ -40,13 +40,22 @@ class App extends ConsumerStatefulWidget {
   ConsumerState<App> createState() => _AppState();
 }
 
-class _AppState extends ConsumerState<App> {
+class _AppState extends ConsumerState<App> with WidgetsBindingObserver {
   bool _fcmRegistered = false;
   bool _authProvidersPreloaded = false;
+  // Tracks whether the OS has paused/detached this isolate. The
+  // activeSessionProvider runs a 15s poll (see active_session_notifier.dart);
+  // each tick fires the listener below, which would otherwise re-open the
+  // chat WebSocket immediately after didChangeAppLifecycleState closed it
+  // — defeating the WS→FCM fallback. We gate the reconnect on this flag so
+  // the WS stays closed while the app is backgrounded, even as polling
+  // continues.
+  bool _appPaused = false;
 
   @override
   void initState() {
     super.initState();
+    WidgetsBinding.instance.addObserver(this);
     // Phase 4: preload server-driven auth-provider gating once on cold start.
     // Cached via @Riverpod(keepAlive: true) — subsequent reads are instant.
     WidgetsBinding.instance.addPostFrameCallback((_) {
@@ -56,6 +65,45 @@ class _AppState extends ConsumerState<App> {
     });
   }
 
+  @override
+  void dispose() {
+    WidgetsBinding.instance.removeObserver(this);
+    super.dispose();
+  }
+
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    // Background → close the chat WebSocket so backend `sendMessage` falls
+    // back to FCM (chat.service.js:51 — `if (!delivered) sendPushNotification`).
+    // Without this, Android keeps the TCP socket alive after the Dart
+    // isolate is paused, so the backend believes the customer is online and
+    // never fires the push — the user sees no alert until they reopen the
+    // app. See flow_customer.mermaid.md §5 (chat room) and the
+    // implementation note in main.dart's activeSession listener.
+    //
+    // Foreground → re-establish the WS for the current active session, if
+    // any. activeSessionProvider's last cached snapshot drives the target
+    // session id; the chat notifier's `connectIfNotConnected` is a no-op
+    // when the same session is already wired up.
+    final notifier = ref.read(chatProvider.notifier);
+    if (state == AppLifecycleState.paused ||
+        state == AppLifecycleState.detached) {
+      _appPaused = true;
+      if (notifier.connectedSessionId != null) {
+        notifier.disconnect();
+      }
+    } else if (state == AppLifecycleState.resumed) {
+      _appPaused = false;
+      final snapshot = ref.read(activeSessionProvider).valueOrNull;
+      final sessionId = snapshot?.sessionId;
+      if (sessionId != null &&
+          (snapshot?.hasSession ?? false) &&
+          notifier.connectedSessionId != sessionId) {
+        notifier.connectIfNotConnected(sessionId);
+      }
+    }
+  }
+
   void _registerFcmToken() {
     if (_fcmRegistered) return;
     _fcmRegistered = true;
@@ -88,6 +136,12 @@ class _AppState extends ConsumerState<App> {
     // active session, regardless of which screen is mounted. The chat screen
     // only joins this connection — it doesn't own it. FCM remains the
     // background-only fallback.
+    //
+    // Gate on `_appPaused`: activeSessionProvider runs a 15s poll that fires
+    // this listener on every tick. If we reconnect while the app is
+    // backgrounded, we undo the disconnect that didChangeAppLifecycleState
+    // just performed and the FCM fallback never triggers for messages that
+    // arrive during background.
     ref.listen(activeSessionProvider, (prev, next) {
       final snapshot = next.valueOrNull;
       final notifier = ref.read(chatProvider.notifier);
@@ -97,6 +151,7 @@ class _AppState extends ConsumerState<App> {
         }
         return;
       }
+      if (_appPaused) return;
       final sessionId = snapshot.sessionId;
       if (sessionId != null && notifier.connectedSessionId != sessionId) {
         notifier.connectIfNotConnected(sessionId);