fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env

backend/auth/signup.php

@@ -11,7 +11,6 @@ $password    = filterRequest("password");
 $gender      = filterRequest("gender");
 $birthdate   = filterRequest("birthdate");
 $site        = filterRequest("site");
-$id          = filterRequest("id");
 
 // تشفير البيانات الحساسة
 $phone       = $encryptionHelper->encryptData($phone);
@@ -39,14 +38,13 @@ try {
         exit;
     }
 
-    // إدخال البيانات الجديدة
+    // إدخال البيانات الجديدة (مع ID تلقائي)
     $sql = "INSERT INTO passengers (
         id, phone, email, password, gender, birthdate, site, first_name, last_name
     ) VALUES (
-        :id, :phone, :email, :password, :gender, :birthdate, :site, :first_name, :last_name
+        UUID_SHORT(), :phone, :email, :password, :gender, :birthdate, :site, :first_name, :last_name
     )";
     $stmt = $con->prepare($sql);
-    $stmt->bindParam(":id", $id);
     $stmt->bindParam(":phone", $phone);
     $stmt->bindParam(":email", $email);
     $stmt->bindParam(":password", $hashedPassword);