fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth

backend/ride/rides/acceptRide.php

@@ -17,7 +17,8 @@ try {
 
 // ── 1. Input & Validation ──────────────────────────────────────
 $rideId = filterRequest("id");
-$driverId = filterRequest("driver_id");
+// Force driver_id from JWT — never trust user-supplied driver_id
+$driverId = $user_id;
 $status = filterRequest("status");       // القيمة التي يرسلها التطبيق: 'accepted'
 $passengerToken = filterRequest("passengerToken");