Fix #22: Medium-severity fixes (M-01 through M-07)

M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5)
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist

backend/auth/syria/uploadSyrianDocs.php

@@ -10,7 +10,7 @@ const MAX_FILE_MB     = 5;
 const ALLOWED_MIMES   = ['image/jpeg','image/png','image/webp']; // فقط صور
 const UPLOAD_ROOT     = __DIR__ . "/../../private_uploads"; // مجلد خاص (غير عام)
 const SIGN_SECRET     = getenv('SECRET_KEY_HMAC'); // غيّرها واقرأها من .env
-$host = $_SERVER['HTTP_HOST'] ?? 'api-syria.siromove.com';
+$host = getenv('APP_DOMAIN') ?: 'api-syria.siromove.com';
 $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? "https" : "http";
 define('PUBLIC_BASE', "$protocol://$host/siro");
 const SIGNED_TTL_SEC  = 172800; // 2 days = 60*60*24