[GPlay97]

Fixes missing owner trips and shared history, incorrect guest-link expiry, and live updates reaching unauthorized clients.

• Owners can list all their own trips, including scheduled and expired ones. Guest access follows the sharing dates, active owner Premium, and the retained-access setting.
• Live updates go only to clients with the matching authorized share code. Permissions are rechecked before delivery, and both the current server time and the sample timestamp must be inside the sharing window. Missing, invalid, and out-of-window sample timestamps are rejected.
• Shared history selects sessions by recorded sample timestamps, so retained links include delayed uploads even when the log was created after the share ended. Response dates include the selected samples and are clamped to the sharing window; stored logs remain unchanged.
• Partial-session measurements are recalculated from in-window samples. Missing measurements are omitted rather than counted as zero, and incomplete sums are not presented as complete totals. Unknown sessions with zero battery power and a finite average speed contribute to driving averages; explicit session types and valid zero readings are preserved.
• HTTP history and live updates respect location settings. The bundled website supplies socket credentials, separates connection errors from loading errors, and displays unavailable measurements as “–”.

Historical and live sample eligibility uses start <= timestamp < end. History selection converts stored timestamps at read time; no database migration is required.

Validation:

• All 131 TripNotify tests pass, including 21 new regression cases covering sample-time boundaries, invalid timestamps, delayed uploads through the real sync service, bounded response dates, and zero-power classification.
• All 40 existing logs tests pass against an isolated local MongoDB instance.
• The build, TypeScript checks, targeted lint checks, and diff checks pass.
• The full suite was not rerun; an earlier run reported an existing account-guard failure outside this change.

Compatibility: other Socket.IO clients must send auth: { code } when connecting and reconnecting. Clients without these credentials are rejected; there is no unrestricted fallback.