Add AES-256-GCM encryption for sensitive personal data fields

- New backend/src/lib/crypto.ts: encrypt/decrypt (AES-256-GCM) + passportToken (HMAC-SHA256)
- Migration 012: birth_date/passport_issue_date → TEXT, add passport_search_token indexes
- guests.ts: encrypt passport_series/number/birth_date on write, decrypt on read,
  passport search via HMAC token (?passport= param) instead of plaintext LIKE
- booking-guests.ts: encrypt all sensitive fields, search token for passport lookup
- api.ts: guests.list() supports passport= param for exact passport lookup
- BookingDetailPanel: use passport param for passport-based autocomplete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/components/bookings/BookingDetailPanel.tsx

@@ -161,7 +161,7 @@ export function BookingDetailPanel({ booking, room, rooms, allBookings, slug, on
     const query   = (series + number).trim()
     if (query.length < 4 || !slug) return
     passportTimerRef.current = setTimeout(() => {
-      api.guests.list(slug, query)
+      api.guests.list(slug, undefined, query)
         .then(results => {
           if (results.length === 1) selectAcGuest(results[0])
         })

src/lib/api.ts

@@ -292,8 +292,12 @@ export const api = {
 
   // ── Guests ────────────────────────────────────────────────────────────────
   guests: {
-    list: (slug: string, q?: string) =>
-      req<GuestApiType[]>('GET', `/api/hotels/${slug}/guests${q ? `?q=${encodeURIComponent(q)}` : ''}`),
+    list: (slug: string, q?: string, passport?: string) => {
+      const params = passport
+        ? `?passport=${encodeURIComponent(passport)}`
+        : q ? `?q=${encodeURIComponent(q)}` : ''
+      return req<GuestApiType[]>('GET', `/api/hotels/${slug}/guests${params}`)
+    },
 
     get: (slug: string, id: string) =>
       req<GuestApiType>('GET', `/api/hotels/${slug}/guests/${id}`),