Make OTP verification independent of the encryption mode

The verification tables (token_verification*, phone_verification*) use the
phone number as a lookup key: written when the code is sent, read when it is
checked. Storing it encrypted worked only because encryptData() is
deterministic — under AES-GCM the two sides would produce different
ciphertexts and no code would ever verify, locking every user out of
registration and OTP sign-in.

otpPhoneKey() stores a keyed HMAC of the normalised number instead. No schema
change is needed since the column is textual, local and international formats
now resolve to the same key, and the value cannot be reversed without the
pepper. It falls back to the previous behaviour when no pepper is configured.

Applied to both sides of every affected flow — request/verify, and the driver
and passenger send/verify pairs — including the OTP value itself where it is
compared by equality rather than decrypted. auth/otp/verify.php already
decrypts the token before comparing, so it needed no change there.

Also adds ENCRYPTION_MODE to EncryptionHelper: encryptData() writes GCM when
set to 'gcm', CBC otherwise. Verified in both directions — rows written under
CBC stay readable after switching, and rows written under GCM stay readable
after rolling back — so the switch is reversible by an environment variable.

The admin console's own OTP is unaffected: it keys the table by the stored
ciphertext read from adminUser, identical on both sides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/core/Security/EncryptionHelper.php

@@ -14,7 +14,16 @@ class EncryptionHelper
     private const TAG_LEN = 16;
     private const PREFIX_GCM = 'GCM:'; // للتمييز بين الجديد والقديم
 
-    public function __construct(string $key, ?string $cbcIv = null)
+    /**
+     * وضع الكتابة: 'cbc' (افتراضي) أو 'gcm'.
+     *
+     * القراءة غير متأثرة بهذا الوضع إطلاقاً — decryptData تتعرّف على الصيغتين
+     * عبر البادئة، فالسجلات القديمة تبقى مقروءة بلا ترحيل، والرجوع عن التحويل
+     * لا يُفقد أي سجل كُتب بـ GCM.
+     */
+    private string $writeMode;
+
+    public function __construct(string $key, ?string $cbcIv = null, ?string $writeMode = null)
     {
         if (strlen($key) !== 32) {
             throw new InvalidArgumentException('Encryption key must be exactly 32 bytes.');
@@ -22,10 +31,34 @@ class EncryptionHelper
         $this->key = $key;
         // IV القديم للتوافقية أثناء مرحلة المايغريشن
         $this->cbcIv = $cbcIv ?: getenv('initializationVector') ?: str_repeat('0', 16);
+
+        $mode = strtolower($writeMode ?: (getenv('ENCRYPTION_MODE') ?: 'cbc'));
+        $this->writeMode = $mode === 'gcm' ? 'gcm' : 'cbc';
     }
 
-    // ─── تشفير نص باستخدام AES-256-CBC الحتمي ──
+    public function writeMode(): string
+    {
+        return $this->writeMode;
+    }
+
+    /**
+     * نقطة التشفير الموحّدة لكل التطبيق.
+     *
+     * حتى الآن كانت CBC بـ IV ثابت، أي حتمية: نفس النص ينتج نفس التشفير، وهو
+     * ما كان يسمح بالبحث عبر مقارنة النص المشفّر، لكنه يسرّب المساواة
+     * والبادئات المشتركة. مع ENCRYPTION_MODE=gcm يصبح التشفير عشوائياً
+     * وموثَّقاً، ويتكفّل الفهرس الأعمى (BlindIndex) بالبحث.
+     */
     public function encryptData(string $plainText): string
+    {
+        if ($this->writeMode === 'gcm') {
+            return $this->encryptDataGCM($plainText);
+        }
+        return $this->encryptDataCBC($plainText);
+    }
+
+    // ─── تشفير نص باستخدام AES-256-CBC الحتمي (للتوافقية والرجوع) ──
+    public function encryptDataCBC(string $plainText): string
     {
         $plainText = mb_convert_encoding($plainText, 'UTF-8');
         $padded = $this->addPadding($plainText);