Fix broadcast delivery; make transit organisations manageable

Broadcasts never reached anyone. The internal FCM call defaulted to
127.0.0.1, which inside the php container is the php container itself — the
web server runs in a separate nginx container, reachable by service name on
the Compose network. Every send failed the curl and returned a generic 502.
The default now points at nginx, the URL is overridable via FCM_INTERNAL_URL,
and the error carries the actual reason and target instead of a bare status.

Transit organisations were a read-only count table with nothing to act on.
The module now supports the operations an admin actually needs:
- open an organisation for its counts, routes, recent trips and admins
- create one, including the founding administrator create.php requires
- edit city, contact details, contract status and trial end, with a
  confirmation when the contract changes since suspending cuts off service
- add an administrator, and enable or disable an existing one

Verified end to end against the endpoints' real payload shapes, including
that an incomplete create form is rejected before any request is sent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/Admin/notifications/broadcast.php

@@ -76,7 +76,9 @@ if (function_exists('logAudit')) {
 }
 
 // الاستدعاء الداخلي لخدمة FCM
-$fcmUrl = getenv('FCM_INTERNAL_URL') ?: 'http://127.0.0.1/backend/ride/firebase/send_fcm.php';
+// من داخل حاوية php لا يوجد خادم ويب على 127.0.0.1 — الويب في حاوية nginx
+// منفصلة، وتُعرف داخل شبكة Compose باسم الخدمة. هذا كان سبب فشل كل إشعار.
+$fcmUrl = getenv('FCM_INTERNAL_URL') ?: 'http://nginx/backend/ride/firebase/send_fcm.php';
 $payload = json_encode([
     'target'  => $topic,
     'title'   => $title,
@@ -106,8 +108,9 @@ $curlErr  = curl_error($ch);
 curl_close($ch);
 
 if ($response === false || $httpCode >= 400) {
-    error_log("[Broadcast] FCM call failed (HTTP $httpCode): " . ($curlErr ?: $response));
-    jsonError("Notification service rejected the request (HTTP $httpCode).", 502);
+    $reason = $curlErr ?: (is_string($response) ? substr($response, 0, 200) : 'no response');
+    error_log("[Broadcast] FCM call failed (HTTP $httpCode) via $fcmUrl: $reason");
+    jsonError("Notification service unreachable at $fcmUrl — $reason", 502);
 }
 
 $decoded = json_decode((string) $response, true);