Close the remaining ciphertext joins and a SQL injection in email verification

- Customer-service notes joined to the account by comparing encrypted phone
  columns. Both notes tables now carry phone_key, written when a note is
  saved, and the three joins match on it.
- The email_verifications join was comparing a plaintext column against an
  encrypted one, so it never matched and `verified` was always NULL in both
  passenger and driver sign-in. It is now resolved in PHP against the
  decrypted address, which fixes a pre-existing bug rather than only
  preparing for GCM.
- auth/sendVerifyEmail.php built all three of its statements by interpolating
  the request values into SQL. Any caller could inject through the email or
  token field. Now parameterised.
- serviceapp/register.php duplicate detection consults the users indexes and
  writes them with the row.

Sweep confirms no join or lookup compares two encrypted columns any more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/auth/driver/login.php

@@ -25,13 +25,34 @@ $sql = "SELECT
     driver.maritalStatus,
     driver.created_at,
     driver.updated_at,
-    email_verifications.verified
+    driver.email AS _email_enc
 FROM
     driver
-LEFT JOIN email_verifications ON email_verifications.email = driver.email
 WHERE
     driver.phone = :phone AND driver.email = :email";
 
+
+/**
+ * حالة توثيق البريد.
+ *
+ * كان الاستعلام يربط email_verifications.email بعمود البريد في الحساب، لكن
+ * الأول يُخزَّن نصاً صريحاً والثاني مشفّراً — فالربط لم يكن يطابق شيئاً أصلاً
+ * وكانت verified تعود NULL دائماً. نجلبها هنا بالبريد الأصلي.
+ */
+function fetchEmailVerified(PDO $con, ?string $plainEmail): ?int
+{
+    if (!$plainEmail) return null;
+    try {
+        $st = $con->prepare("SELECT verified FROM email_verifications WHERE email = ? LIMIT 1");
+        $st->execute([$plainEmail]);
+        $v = $st->fetchColumn();
+        return $v === false ? null : (int) $v;
+    } catch (PDOException $e) {
+        error_log('[email_verifications] ' . $e->getMessage());
+        return null;
+    }
+}
+
 $stmt = $con->prepare($sql);
 $stmt->bindParam(':email', $email);
 $stmt->bindParam(':phone', $phone);
@@ -39,6 +60,12 @@ $stmt->execute();
 $data = $stmt->fetchAll(PDO::FETCH_ASSOC);
 $count = $stmt->rowCount();
 
+if ($count > 0) {
+    $plainEmail = $encryptionHelper->decryptData($data[0]['_email_enc'] ?? null) ?: null;
+    $data[0]['verified'] = fetchEmailVerified($con, $plainEmail);
+    unset($data[0]['_email_enc']);
+}
+
 if ($count > 0) {
     $stored_password = $data[0]['password'];
     if (password_verify($password, $stored_password)) {