Fix dashbord.php parse error; require super_admin on pricing and crypto tools

Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.

Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:

- Admin/ggg.php decrypts any database field and was authorised solely by an
  admin phone number sent in the request body. Anyone who knew a listed
  number could decrypt platform data without signing in. It now runs behind
  connect.php, requires super_admin, keeps the phone list as a second factor,
  and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
  changed live pricing and discount codes with no role check at all, so any
  valid token — including a driver's or passenger's — could rewrite the fare
  table. All now require super_admin.

Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.

Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/ride/promo/delete.php

@@ -1,6 +1,18 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
+// حارس الصلاحيات: هذه النقطة تعدّل التسعير/الأكواد الترويجية على الإنتاج.
+// connect.php يتحقق من صحة التوكن فقط، لذا بدون هذا الفحص كان أي توكن صالح
+// (سائق أو راكب) قادراً على تعديلها.
+if ($role !== 'super_admin') {
+    http_response_code(403);
+    echo json_encode([
+        'status'  => 'failure',
+        'message' => 'Forbidden. Super Admin access required.',
+    ]);
+    exit;
+}
+
 $id = filterRequest("id");
 
 $sql = "DELETE FROM `promos` WHERE `id` = :id";