Close the remaining ciphertext joins and a SQL injection in email verification

- Customer-service notes joined to the account by comparing encrypted phone
  columns. Both notes tables now carry phone_key, written when a note is
  saved, and the three joins match on it.
- The email_verifications join was comparing a plaintext column against an
  encrypted one, so it never matched and `verified` was always NULL in both
  passenger and driver sign-in. It is now resolved in PHP against the
  decrypted address, which fixes a pre-existing bug rather than only
  preparing for GCM.
- auth/sendVerifyEmail.php built all three of its statements by interpolating
  the request values into SQL. Any caller could inject through the email or
  token field. Now parameterised.
- serviceapp/register.php duplicate detection consults the users indexes and
  writes them with the row.

Sweep confirms no join or lookup compares two encrypted columns any more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/scripts/migrate.php

@@ -89,6 +89,11 @@ $columns = [
     ['driver',     'phone_key', "VARCHAR(80) NULL DEFAULT NULL COMMENT 'مفتاح ربط جداول التحقق'"],
     ['passengers', 'phone_key', "VARCHAR(80) NULL DEFAULT NULL COMMENT 'مفتاح ربط جداول التحقق'"],
 
+    // جداول ملاحظات خدمة العملاء تُربط بالسائق/الراكب عبر الهاتف المشفّر،
+    // وهو ربط يفشل لحظة أن يصبح التشفير عشوائياً.
+    ['notesForDriverService',    'phone_key', "VARCHAR(80) NULL DEFAULT NULL COMMENT 'مفتاح ربط بالحساب'"],
+    ['notesForPassengerService', 'phone_key', "VARCHAR(80) NULL DEFAULT NULL COMMENT 'مفتاح ربط بالحساب'"],
+
     // بقية الجداول التي يُبحث فيها بحقل مشفّر
     ['users',      'email_bidx',    "CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC لبريد موظف الخدمة'"],
     ['users',      'phone_bidx',    "CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC لهاتف موظف الخدمة'"],
@@ -114,6 +119,8 @@ $indexes = [
     ['driver',     'idx_driver_national_bidx',  'national_bidx'],
     ['driver',     'idx_driver_phone_key',      'phone_key'],
     ['passengers', 'idx_passengers_phone_key',  'phone_key'],
+    ['notesForDriverService',    'idx_notes_driver_phone_key',    'phone_key'],
+    ['notesForPassengerService', 'idx_notes_passenger_phone_key', 'phone_key'],
 ];
 
 $applied = 0;