Require admin auth on api/search-customers.php

Was callable anonymously, leaking customer email/phone/wallet balance/reward
points to anyone who could guess a search term. Gated behind AdminAuth,
matching the pattern used elsewhere (401 JSON response, not a redirect,
since this is an API endpoint called via fetch from admin/pos.php).

api/search-customers.php

@@ -6,6 +6,11 @@
 header('Content-Type: application/json');
 
 require_once __DIR__ . '/../includes/functions.php';
+require_once __DIR__ . '/../includes/auth.php';
+
+if (!AdminAuth::isLoggedIn()) {
+    jsonResponse(['error' => 'Unauthorized'], 401);
+}
 
 $query = $_GET['q'] ?? '';