Add AES-256-GCM encryption for sensitive personal data fields

- New backend/src/lib/crypto.ts: encrypt/decrypt (AES-256-GCM) + passportToken (HMAC-SHA256)
- Migration 012: birth_date/passport_issue_date → TEXT, add passport_search_token indexes
- guests.ts: encrypt passport_series/number/birth_date on write, decrypt on read,
  passport search via HMAC token (?passport= param) instead of plaintext LIKE
- booking-guests.ts: encrypt all sensitive fields, search token for passport lookup
- api.ts: guests.list() supports passport= param for exact passport lookup
- BookingDetailPanel: use passport param for passport-based autocomplete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/migrations/012_encrypt_setup.sql

@@ -0,0 +1,28 @@
+-- Migration 012: подготовка схемы для шифрования чувствительных полей
+-- birth_date и passport_issue_date меняем с DATE на TEXT (для хранения зашифрованных значений)
+-- Добавляем passport_search_token — HMAC-индекс для поиска без расшифровки
+
+-- ── guests ────────────────────────────────────────────────────────────────────
+ALTER TABLE guests
+  ALTER COLUMN birth_date TYPE TEXT USING birth_date::TEXT;
+
+ALTER TABLE guests
+  ADD COLUMN IF NOT EXISTS passport_search_token VARCHAR(64);
+
+CREATE INDEX IF NOT EXISTS idx_guests_passport_token
+  ON guests(hotel_id, passport_search_token)
+  WHERE passport_search_token IS NOT NULL;
+
+-- ── booking_guests ────────────────────────────────────────────────────────────
+ALTER TABLE booking_guests
+  ALTER COLUMN birth_date       TYPE TEXT USING birth_date::TEXT;
+
+ALTER TABLE booking_guests
+  ALTER COLUMN passport_issue_date TYPE TEXT USING passport_issue_date::TEXT;
+
+ALTER TABLE booking_guests
+  ADD COLUMN IF NOT EXISTS passport_search_token VARCHAR(64);
+
+CREATE INDEX IF NOT EXISTS idx_booking_guests_passport_token
+  ON booking_guests(hotel_id, passport_search_token)
+  WHERE passport_search_token IS NOT NULL;