Report Whereabouts From Device

A fix from a background wake, on the phone's own DEVICE KEY.

iOS relaunches the app cold for a significant location change and there is no session in that process — the web hands this container its Supabase session over postMessage and nothing persists it. So the phone carries a key minted when it reported its permissions, and this is the only route that key opens: append a fix to that one phone's row, in a team it is already registered in. It is never a bearer for the team, and the grant is re-checked server-side (Devices.whereabouts) so revoking location stops the writes even if a stale bundle keeps sending them.