Add blind-index search layer; fix captain detail 200-with-empty-body

Searching encrypted columns currently works only because encryptData() is
AES-CBC with a fixed IV, i.e. deterministic. That determinism is what leaks
equality and shared prefixes, and it is why moving storage to AES-GCM would
break every lookup. This separates the two concerns.

- core/Security/BlindIndex.php: HMAC-SHA256 over a normalised value, keyed by
  a secret pepper. Phone numbers have a small keyspace, so a bare SHA-256
  would be reversible by enumeration; the pepper lives in the environment, not
  the database. The scope string includes table and field so the same number
  does not produce a matching index across tables.
  Normalisation unifies local/international phone forms, lowercases emails and
  folds Arabic alef/ya/ta-marbuta and diacritics for names.
- migrations/: nullable *_bidx columns plus indexes, and the missing
  adminUser.status/approved_by/approved_at columns that admin approvals need.
- scripts/backfill_blind_index.php: restartable, batched, --dry-run capable,
  touches only index columns.
- Admin lookups by phone/email now match the index, keeping the old ciphertext
  comparison in the same query so search keeps working until the backfill runs.
  bootstrap exposes $blindIndex as null when no pepper is configured.

Also: AdminCaptain/getCaptainDetailsById.php selected driver.education, a
column absent from this schema. The PDOException was uncaught, so the client
received an empty body with HTTP 200 — the "non-JSON response" seen when
opening a captain. It now omits the column, catches the error, reports it as
JSON, and requires an admin role.

Console: opening any sidebar section refetches its data instead of showing
what was loaded when the console started.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dashboard/siro-admin/index.html

@@ -15,7 +15,7 @@
   <!-- ?v= must be bumped whenever css/main.css or js/app.js changes: the files
        are served straight off a bind mount, so without it browsers keep
        running the previously cached build after a deploy. -->
-  <link rel="stylesheet" href="css/main.css?v=2026-07-25-6">
+  <link rel="stylesheet" href="css/main.css?v=2026-07-25-7">
 </head>
 <body>
 
@@ -609,6 +609,6 @@
     </div>
   </div>
 
-  <script src="js/app.js?v=2026-07-25-6"></script>
+  <script src="js/app.js?v=2026-07-25-7"></script>
 </body>
 </html>