Fix dashbord.php parse error; require super_admin on pricing and crypto tools

Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.

Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:

- Admin/ggg.php decrypts any database field and was authorised solely by an
  admin phone number sent in the request body. Anyone who knew a listed
  number could decrypt platform data without signing in. It now runs behind
  connect.php, requires super_admin, keeps the phone list as a second factor,
  and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
  changed live pricing and discount codes with no role check at all, so any
  valid token — including a driver's or passenger's — could rewrite the fare
  table. All now require super_admin.

Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.

Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/Admin/ggg.php

@@ -4,17 +4,33 @@
 // أداة تشفير وفك تشفير للمشرفين
 // ============================================================
 
-require_once __DIR__ . '/../core/bootstrap.php';
+// ============================================================
+// المصادقة: هذه الأداة تفك تشفير أي حقل في قاعدة البيانات، لذا تمر عبر
+// connect.php (JWT + بصمة الجهاز + Rate limiting) ثم تتطلب دور super_admin.
+//
+// سابقاً كان الإذن الوحيد هو رقم هاتف يُرسل داخل جسم الطلب نفسه — وهو ليس
+// سرّاً: أي شخص يعرف رقماً من القائمة كان يستطيع فك تشفير بيانات المنصة
+// كاملةً بلا تسجيل دخول. أُبقيت قائمة الأرقام كطبقة ثانية فوق التوكن.
+// ============================================================
+require_once __DIR__ . '/../connect.php';
 
 // نضمن أن الرد دائماً JSON
 header('Content-Type: application/json; charset=utf-8');
 
+if ($role !== 'super_admin') {
+    securityLog("Unauthorized encrypt/decrypt attempt", [
+        'user_id' => $user_id ?? 'unknown',
+        'role'    => $role ?? 'none',
+    ]);
+    jsonError('Forbidden. Super Admin access required.', 403);
+}
+
 // 1) قراءة الـ body كـ JSON أو POST
 $action = filterRequest('action');
 $text   = filterRequest('text');
 $adminPhoneParam = filterRequest('admin_phone');
 
-// 2) التحقق من رقم هاتف الأدمن المصرّح له
+// 2) طبقة ثانية: رقم الهاتف يجب أن يكون ضمن القائمة المصرّح لها (إن وُجدت)
 $phonesRaw = getenv('ADMIN_PHONE_NUMBERS') ?: '';
 $ALLOWED_TOOL_PHONES = array_values(
     array_filter(
@@ -26,11 +42,22 @@ $ALLOWED_TOOL_PHONES = array_values(
 
 $adminPhoneParam = $adminPhoneParam ? preg_replace('/\D+/', '', $adminPhoneParam) : '';
 
-if ($adminPhoneParam === '' || !in_array($adminPhoneParam, $ALLOWED_TOOL_PHONES, true)) {
-    securityLog("Unauthorized encrypt/decrypt attempt", ['phone' => $adminPhoneParam]);
+if (!empty($ALLOWED_TOOL_PHONES)
+    && ($adminPhoneParam === '' || !in_array($adminPhoneParam, $ALLOWED_TOOL_PHONES, true))) {
+    securityLog("Encrypt/decrypt phone not in allow-list", [
+        'user_id' => $user_id ?? 'unknown',
+        'phone'   => $adminPhoneParam,
+    ]);
     jsonError('Access denied for this admin phone.', 403);
 }
 
+// 3) سجل تدقيق: كل استخدام لهذه الأداة يُسجَّل مع هوية المنفّذ
+securityLog("Encryption tool used", [
+    'user_id' => $user_id ?? 'unknown',
+    'action'  => $action,
+    'ip'      => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
+]);
+
 if (empty($text) || ($action !== 'encrypt' && $action !== 'decrypt')) {
     jsonError('Invalid input: need action=encrypt|decrypt and non-empty text.', 400);
 }