Add campaign launcher and app version manager; fix SQL injection in updatePackages

serviceapp/updatePackages.php built its UPDATE by interpolating the request
values straight into the SQL string, so any caller with a valid token could
execute arbitrary SQL through the version field. It now uses bound
parameters, requires an admin role, validates the version format, and writes
an audit entry.

trigger_campaign.php gains dry_run=1: it performs the same Gemini analysis
and target selection but returns before creating the promo code and before
dispatching any notification. Launching without previewing was the only
option before, and a launch writes a seven-day discount and pushes to every
passenger in the country.

Console:
- Campaign launcher with a mandatory preview. Launching stays disabled until
  the current parameters have been previewed, and re-locks if any parameter
  changes afterwards or once a launch completes.
- App version manager with the same version-format check as the server and a
  confirmation naming the old and new values.

Cache busting: assets are served straight off a bind mount with no version,
so browsers kept running the previously cached build after a deploy. Both
asset links now carry ?v=, and the build id is shown in Session & Security
and printed in the diagnostics report.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/Admin/marketing/trigger_campaign.php

@@ -109,6 +109,22 @@ try {
     $dispatchedPassengers = [];
     $fcmErrors = [];
 
+    // 5.5 وضع المعاينة: يُرجع ما ستفعله الحملة (النص، الكود، حجم الجمهور)
+    // دون إنشاء كود ترويجي ودون إرسال أي إشعار. الحملة تُنشئ خصماً حقيقياً
+    // وتصل كل ركاب الدولة، فوجود معاينة قبل الإطلاق ضروري.
+    if (filterRequest('dry_run') === '1') {
+        jsonSuccess([
+            'dry_run'          => true,
+            'campaign_created' => false,
+            'promo_code'       => $promoCode,
+            'discount_percent' => $discountVal,
+            'region'           => $regionName,
+            'country_code'     => strtoupper($countryCode),
+            'audience_size'    => count($targets),
+            'ai_analysis'      => $aiCampaign,
+        ], 'Preview only — no promo code was created and no notification was sent.');
+    }
+
     // 6. Save broadcast promo for this campaign (Option 1 - promos table adjustment)
     $sqlPromo = "INSERT INTO promos 
                  (promo_code, amount, description, passengerID, source, validity_start_date, validity_end_date)