Fix admin status handling for the current ride pipeline; extend console

The ride table holds two generations of status values: the legacy CamelCase
set ('Finished', 'CancelFromPassenger') and the lowercase set written by
backend/ride/rides/* today ('completed', 'cancelled_by_passenger'). Admin
queries only matched the legacy set, so on live data:

- get_rides_by_status.php returned nothing meaningful for every filter, and
  the "in progress" default masked it.
- dashbord.php reported total_driver_earnings as NULL, completed_rides as a
  fraction of the real count, and cancelled_rides as 0.
- driver_avg_duration averaged in negative durations, yielding "-00h 22m".

All three now match on LOWER(status) across both families.

Staff/pending.php ran with no authentication at all, exposing pending
admins' names and phone numbers to any caller; it now goes through
connect.php with a role check. It also returned HTTP 400 for everything when
the `users` table was absent — each source is queried independently and
reports its own availability.

Console:
- Render rides from either schema generation (price/date/time and
  start_location coordinates, or the older address/created_at columns).
- Null aggregates render as "—" rather than a measured 0.00.
- Add tariff/promo, WhatsApp send and encryption modules, all super-admin
  gated; pricing remains read-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dashboard/siro-admin/index.html

@@ -499,6 +499,26 @@
             <div class="mini-list" id="sessionInfo"></div>
           </div>
 
+          <div class="card" data-requires-super hidden>
+            <div class="card-header">
+              <h3 class="card-title">Send WhatsApp message <span class="card-sub">super admin</span></h3>
+            </div>
+            <p class="card-note">
+              Sends a single message through the platform's WhatsApp provider. This leaves the system
+              and reaches a real person — you will be asked to confirm before it is sent.
+            </p>
+            <div class="form-group">
+              <input type="text" class="form-input" id="waReceiver" placeholder="Recipient phone, e.g. 962798583052" style="padding-left:1rem;">
+            </div>
+            <div class="form-group">
+              <textarea class="form-input decrypt-area" id="waMessage" rows="3" placeholder="Message text"></textarea>
+            </div>
+            <div class="api-base-row">
+              <button class="btn btn-secondary btn-sm" id="waSendBtn"><i class="ph ph-paper-plane-tilt"></i> <span>Send message</span></button>
+              <span class="stamp" id="waStatus"></span>
+            </div>
+          </div>
+
           <div class="card" data-requires-super hidden>
             <div class="card-header">
               <h3 class="card-title">Encryption tool <span class="card-sub">super admin</span></h3>