Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8)

Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising.

Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it.

New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable.

Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement.

Quick Send asks for confirmation; confirm-link extended to submit buttons.

Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.

client/functions.php

@@ -72,6 +72,36 @@ function enforceContactCan($capability) {
     }
 }
 
+/*
+ * Confirms the person at the keyboard is the account holder, before a change
+ * that would let someone who hijacked a session take the account over or
+ * defeat phone verification.
+ *
+ * Returns true for SSO contacts without checking anything: there is no local
+ * password to compare against, and the identity provider has already done this
+ * work. Gating them on a password they do not have would just lock them out.
+ */
+function portalReauthenticate($current_password) {
+    global $mysqli, $session_user_id;
+
+    if (($_SESSION['login_method'] ?? 'local') !== 'local') {
+        return true;
+    }
+
+    if (empty($current_password)) {
+        return false;
+    }
+
+    $sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id LIMIT 1");
+    $row = mysqli_fetch_assoc($sql);
+
+    if (!$row || empty($row['user_password'])) {
+        return false;
+    }
+
+    return password_verify($current_password, $row['user_password']);
+}
+
 /*
  * A timestamp a person can read, in the company's configured date and time
  * format rather than the raw DATETIME the database hands back.