Migrate remaining encrypted-column lookups to the blind index

Completes the set of queries that matched a freshly encrypted value against a
stored one, which only works while encryption is deterministic. Each keeps its
original comparison and adds an index comparison in the same WHERE, so nothing
changes today.

- passenger sign-in by email, service-staff sign-in, Firebase token lookup
- driver lookup by phone and by national number
- admin ride lookup and ride monitor (both tables)
- nabeh: driver status, user resolution, ride history, complaint submission

transit_org_admins lives in the transit database and has no index column, so
login there falls back to decrypting the small set of active admins and
comparing normalised numbers.

Schema: adds users.email_bidx/phone_bidx and driver.national_bidx with their
indexes.

Verified that every :*_bidx placeholder introduced is actually bound — an
unbound one is a fatal error at request time, not a silent miss.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/auth/passenger/loginUsingCredentialsWithoutGoogle.php

@@ -40,6 +40,8 @@ try {
     
     // تشفير الإيميل للبحث في قاعدة البيانات
     $encryptedEmail = $encryptionHelper->encryptData($email);
+    global $blindIndex;
+    $emailBidx = $blindIndex ? $blindIndex->index('passengers.email', $email) : null;
 
     // Auto-seed/create tester passenger logic removed for security
 
@@ -54,11 +56,12 @@ try {
                 ON phone_verification_passenger.phone_number = p.phone
             LEFT JOIN invitesToPassengers 
                 ON invitesToPassengers.inviterPassengerPhone = p.phone
-            WHERE p.email = :email
+            WHERE p.email = :email OR (:email_bidx IS NOT NULL AND p.email_bidx = :email_bidx)
             LIMIT 1";
 
     $stmt = $con->prepare($sql);
     $stmt->bindParam(':email', $encryptedEmail);
+    $stmt->bindParam(':email_bidx', $emailBidx);
     $stmt->execute();
 
     $data = $stmt->fetch(PDO::FETCH_ASSOC);