Fix dashbord.php parse error; require super_admin on pricing and crypto tools

Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.

Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:

- Admin/ggg.php decrypts any database field and was authorised solely by an
  admin phone number sent in the request body. Anyone who knew a listed
  number could decrypt platform data without signing in. It now runs behind
  connect.php, requires super_admin, keeps the phone list as a second factor,
  and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
  changed live pricing and discount codes with no role check at all, so any
  valid token — including a driver's or passenger's — could rewrite the fare
  table. All now require super_admin.

Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.

Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/Admin/Staff/pending.php

@@ -18,7 +18,28 @@ $sources = [];
 
 // كل مصدر يُجلب على حدة: غياب جدول users في بعض عمليات النشر كان يُفشل
 // الطلب بالكامل ويخفي طلبات المشرفين المعلقة أيضاً.
+/**
+ * بعض عمليات النشر أنشأت adminUser بلا عمود status (انظر schema_primary.sql)،
+ * وعندها لا يمكن تمييز الحسابات المعلقة أصلاً. نفحص العمود أولاً لنُرجع سبباً
+ * واضحاً بدل فشل عام.
+ */
+function columnExists(PDO $con, string $table, string $column): bool
+{
+    try {
+        $stmt = $con->prepare("SELECT COUNT(*) FROM information_schema.COLUMNS
+                               WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ? AND COLUMN_NAME = ?");
+        $stmt->execute([$table, $column]);
+        return (int) $stmt->fetchColumn() > 0;
+    } catch (Throwable $e) {
+        return false;
+    }
+}
+
 try {
+    if (!columnExists($con, 'adminUser', 'status')) {
+        throw new RuntimeException("adminUser.status column is missing — admin approvals cannot be tracked until it is added.");
+    }
+
     $stmt1 = $con->query("SELECT id, name, phone, role, created_at, 'admin' as type FROM adminUser WHERE status = 'pending'");
     $admins = $stmt1->fetchAll(PDO::FETCH_ASSOC);
 
@@ -32,7 +53,7 @@ try {
     $sources['admins'] = 'ok';
 } catch (Throwable $e) {
     error_log("[Staff Pending] adminUser query failed: " . $e->getMessage());
-    $sources['admins'] = 'unavailable';
+    $sources['admins'] = 'unavailable: ' . $e->getMessage();
 }
 
 try {