Fix duplicate PDO named parameter in api/search-customers.php

Same bug class as the awardPoints() fix - :q was reused three times in one
WHERE clause, which fails under real (non-emulated) prepared statements.
Split into distinct :q1/:q2/:q3 placeholders each bound to the same value.

(The other flagged file, admin/import-export.php, turned out to be a false
positive from the earlier scan - the duplicate ":checked"/"::before" matches
were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)

api/search-customers.php

@@ -16,10 +16,10 @@ if (strlen($query) < 2) {
 $customers = db()->fetchAll(
     "SELECT customer_id, email, name, phone, wallet_balance, reward_points 
      FROM customers 
-     WHERE (email LIKE :q OR name LIKE :q OR phone LIKE :q) AND is_active = 1
+     WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
      ORDER BY name ASC
      LIMIT 20",
-    ['q' => '%' . $query . '%']
+    ['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
 );
 
 jsonResponse($customers);