Close the remaining ciphertext joins and a SQL injection in email verification

- Customer-service notes joined to the account by comparing encrypted phone
  columns. Both notes tables now carry phone_key, written when a note is
  saved, and the three joins match on it.
- The email_verifications join was comparing a plaintext column against an
  encrypted one, so it never matched and `verified` was always NULL in both
  passenger and driver sign-in. It is now resolved in PHP against the
  decrypted address, which fixes a pre-existing bug rather than only
  preparing for GCM.
- auth/sendVerifyEmail.php built all three of its statements by interpolating
  the request values into SQL. Any caller could inject through the email or
  token field. Now parameterised.
- serviceapp/register.php duplicate detection consults the users indexes and
  writes them with the row.

Sweep confirms no join or lookup compares two encrypted columns any more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/serviceapp/addNotesDriver.php

@@ -9,10 +9,12 @@ $editor = filterRequest("editor");
 
 // Encrypt the phone number
 $encryptedPhone = $encryptionHelper->encryptData($phone);
+// مفتاح الربط بالحساب — نفس صيغة otpPhoneKey المستعملة في phone_key
+$phoneKey = otpPhoneKey($phone);
 
 // SQL query: insert new row OR update existing one if phone already exists
-$sql = "INSERT INTO `notesForDriverService` (`phone`, `note`, `editor`) 
-        VALUES (:phone, :note, :editor)
+$sql = "INSERT INTO `notesForDriverService` (`phone`, `phone_key`, `note`, `editor`) 
+        VALUES (:phone, :phone_key, :note, :editor)
         ON DUPLICATE KEY UPDATE 
             `note` = VALUES(`note`),
             `editor` = VALUES(`editor`)";
@@ -22,6 +24,7 @@ $stmt = $con->prepare($sql);
 
 // Bind the parameters
 $stmt->bindParam(':phone', $encryptedPhone);
+$stmt->bindParam(':phone_key', $phoneKey);
 $stmt->bindParam(':note', $note);
 $stmt->bindParam(':editor', $editor);