feat: MobileNumber auth + optional metadata on /employee/login

[Aadil-Ahmed-27]

Summary

Extends POST /internal/fleet-operator/{gtfs_id}/employee/login with a second auth flow and optional richer responses, consolidating the conductor/manager lookup use case into the existing endpoint rather than adding a new one.

New behaviour

• auth_type: \"MobileNumber\" — verify an employee by mobile_no + optional token_no. Existing Email auth is unchanged on the success path.
• ?withMetadata=true — optional query param; when set, the response includes EmployeeMetadata { first_name, last_name, mobile_no, depot_name, depot_code }.
• gtfs_id routing for mobile auth:
  • chennai_bus → primary employees+designations first, fall back to employees_internal+designations_internal.
  • Any other gtfs_id → internal pool only, filtered by e.gtfs_id.
• Optional token verification — when token_no is absent the server returns verified: true if the phone resolves; when present, it must match.
• Typed error reasons added: PERSON_NOT_FOUND, TOKEN_MISMATCH, EMAIL_AUTH_FAILED, MISSING_MOBILE_NO, MISSING_EMAIL_HASH, MISSING_PASSWORD_HASH, MISSING_AUTH_TYPE.
• Role::Manager added (driver | conductor | manager). Email path filters Manager to None for now so the driver-app Haskell catch-all stays correct until that side is updated.
• Depot info comes from a new gtfs-aware in-memory cache on DBVehicleReader (entity_id → { name, code }, 2-hour TTL), populated lazily from entities or entities_internal. No more entities JOIN in the employee query.

Notes

• Backward-compatible for existing email-auth callers — success responses are unchanged. Failure responses now include an error field (additive).
• GTFSService::load_initial_data start-up failures are now soft (logs warn!) instead of crashing the boot. Will be split into its own PR after a follow-up commit.

Test plan

• Email auth — valid creds, kolkata_bus → verified:true, role:driver
• Email auth — wrong hashes → verified:false, error:EMAIL_AUTH_FAILED
• Mobile — kolkata_bus, internal-only path → success
• Mobile — kolkata_bus + withMetadata=true → metadata populated
• Mobile — chennai_bus, primary hit, withMetadata=true → success
• Mobile — no token_no → verification skipped, verified:true
• Mobile — wrong token → TOKEN_MISMATCH
• Mobile — nonexistent phone → PERSON_NOT_FOUND
• Mobile — missing mobile_no → MISSING_MOBILE_NO
• Mobile — chennai_bus → internal fallback for a Manager → role:manager