Close the remaining ciphertext joins and a SQL injection in email verification

- Customer-service notes joined to the account by comparing encrypted phone
  columns. Both notes tables now carry phone_key, written when a note is
  saved, and the three joins match on it.
- The email_verifications join was comparing a plaintext column against an
  encrypted one, so it never matched and `verified` was always NULL in both
  passenger and driver sign-in. It is now resolved in PHP against the
  decrypted address, which fixes a pre-existing bug rather than only
  preparing for GCM.
- auth/sendVerifyEmail.php built all three of its statements by interpolating
  the request values into SQL. Any caller could inject through the email or
  token field. Now parameterised.
- serviceapp/register.php duplicate detection consults the users indexes and
  writes them with the row.

Sweep confirms no join or lookup compares two encrypted columns any more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/auth/sendVerifyEmail.php

@@ -4,9 +4,8 @@ require_once __DIR__ . '/../connect.php';
 $email = filterRequest("email");
 $token = filterRequest("token");
 
-$sql = "SELECT * FROM `email_verifications` WHERE `email` = '$email'";
-$stmt = $con->prepare($sql);
-$stmt->execute();
+$stmt = $con->prepare("SELECT * FROM `email_verifications` WHERE `email` = ?");
+$stmt->execute([$email]);
 
 $rowCount = $stmt->rowCount();
 
@@ -41,9 +40,9 @@ SEFER Team.
 
 if ($rowCount > 0) {
     // The email already exists, so update the data
-    $sql = "UPDATE `email_verifications` SET `token` = '$token' WHERE `email` = '$email'";
-    $stmt = $con->prepare($sql);
-    $stmt->execute();
+    // كانت القيم تُدمج في نص الاستعلام مباشرةً — حقن SQL عبر البريد أو الرمز.
+    $stmt = $con->prepare("UPDATE `email_verifications` SET `token` = ? WHERE `email` = ?");
+    $stmt->execute([$token, $email]);
 
     if ($stmt->rowCount() > 0) {
         // The update was successful
@@ -55,9 +54,8 @@ if ($rowCount > 0) {
     }
 } else {
     // The email does not exist, so insert the data
-    $sql = "INSERT INTO `email_verifications` (`email`, `token`) VALUES ('$email', '$token')";
-    $stmt = $con->prepare($sql);
-    $stmt->execute();
+    $stmt = $con->prepare("INSERT INTO `email_verifications` (`email`, `token`) VALUES (?, ?)");
+    $stmt->execute([$email, $token]);
 
     if ($stmt->rowCount() > 0) {
         // The insertion was successful