Migrate remaining encrypted-column lookups to the blind index

Completes the set of queries that matched a freshly encrypted value against a
stored one, which only works while encryption is deterministic. Each keeps its
original comparison and adds an index comparison in the same WHERE, so nothing
changes today.

- passenger sign-in by email, service-staff sign-in, Firebase token lookup
- driver lookup by phone and by national number
- admin ride lookup and ride monitor (both tables)
- nabeh: driver status, user resolution, ride history, complaint submission

transit_org_admins lives in the transit database and has no index column, so
login there falls back to decrypting the small set of active admins and
comparing normalised numbers.

Schema: adds users.email_bidx/phone_bidx and driver.national_bidx with their
indexes.

Verified that every :*_bidx placeholder introduced is actually bound — an
unbound one is a fatal error at request time, not a silent miss.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/serviceapp/getDriverByPhone.php

@@ -3,6 +3,8 @@ require_once __DIR__ . '/../connect.php';
 
 $phone = filterRequest("phone");
 $encryptedPhone = $encryptionHelper->encryptData($phone); // تشفير الهاتف
+global $blindIndex;
+$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone) : null;
 
 $sql = "SELECT
     COALESCE(
@@ -70,11 +72,12 @@ $sql = "SELECT
     d.*
 FROM driver d
 LEFT JOIN CarRegistration cr ON cr.driverID = d.id
-WHERE d.phone = :phone;
+WHERE d.phone = :phone OR (:phone_bidx IS NOT NULL AND d.phone_bidx = :phone_bidx);
 ";
 
 $stmt = $con->prepare($sql);
 $stmt->bindParam(':phone', $encryptedPhone);
+$stmt->bindParam(':phone_bidx', $phoneBidx);
 $stmt->execute();
 
 if ($stmt->rowCount() > 0) {