Add AES-256-GCM encryption for sensitive personal data fields

- New backend/src/lib/crypto.ts: encrypt/decrypt (AES-256-GCM) + passportToken (HMAC-SHA256)
- Migration 012: birth_date/passport_issue_date → TEXT, add passport_search_token indexes
- guests.ts: encrypt passport_series/number/birth_date on write, decrypt on read,
  passport search via HMAC token (?passport= param) instead of plaintext LIKE
- booking-guests.ts: encrypt all sensitive fields, search token for passport lookup
- api.ts: guests.list() supports passport= param for exact passport lookup
- BookingDetailPanel: use passport param for passport-based autocomplete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/components/bookings/BookingDetailPanel.tsx

@@ -161,7 +161,7 @@ export function BookingDetailPanel({ booking, room, rooms, allBookings, slug, on
     const query   = (series + number).trim()
     if (query.length < 4 || !slug) return
     passportTimerRef.current = setTimeout(() => {
-      api.guests.list(slug, query)
+      api.guests.list(slug, undefined, query)
         .then(results => {
           if (results.length === 1) selectAcGuest(results[0])
         })