feat(auth): one mobile, one person across sales experts and customers

Experts (AdminUser) and customers (Customer) sign in to the same apps by mobile
but live in different tables, so the database cannot make the number unique
across them. A number could be given to an expert and to a customer, and the
login then silently merged the two (the customer row was adopted as the expert's
trading account), which left the expert on a customer session and the panel's
name edits unreachable.

The reference rejected a duplicate at entry (`unique:customers`, the agent being
a customers row too); this does the same where a number is typed in:

- customer create/update (wholesale, banker, walk-in): refused when an ACTIVE
  expert holds the number;
- expert create/update: refused when a customer holds it (the expert's own
  trading account excepted);
- the app's self sign-up: refused when an active expert holds it.

Only a number being created or CHANGED is checked, so existing duplicates keep
signing in and stay editable; the login's "expert wins" adoption is untouched.
Plain equality on the two unique columns, normalised with faToEn, so both
lookups are index hits.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/src/modules/admin-users/admin-users.expert-sync.spec.ts

@@ -38,7 +38,12 @@ describe('AdminUsersService — expert edit reaches the trading account', () =>
           },
         })),
       },
-      customer: { update: customerUpdate, findUnique: jest.fn(async () => customerHolder) },
+      customer: {
+        update: customerUpdate,
+        findUnique: jest.fn(async () => customerHolder),
+        // the cross-table check: does a customer (not the expert's own account) hold the number
+        findFirst: jest.fn(async () => customerHolder),
+      },
     };
     const prisma = {
       ...tx,
@@ -78,11 +83,32 @@ describe('AdminUsersService — expert edit reaches the trading account', () =>
     await free.service.update('exp1', { mobile: '09120001111' });
     expect(free.customerUpdate).toHaveBeenCalledWith({ where: { id: 'cust1' }, data: { mobile: '09120001111' } });
 
+  });
+
+  it('refuses a new mobile a customer already holds, and writes nothing', async () => {
     const taken = build({ id: 'someone-else' });
-    await taken.service.update('exp1', { mobile: '09120001111' });
+    await expect(taken.service.update('exp1', { mobile: '09120001111' })).rejects.toThrow(
+      'این شماره موبایل قبلاً برای یک مشتری ثبت شده است',
+    );
     expect(taken.customerUpdate).not.toHaveBeenCalled();
   });
 
+  it('does not ask about a mobile that is not changing, so an existing duplicate stays editable', async () => {
+    const { service, customerUpdate } = build({ id: 'someone-else' });
+    await expect(service.update('exp1', { mobile: '09902560722', fname: 'سعید1', lname: 'اسماعیلی1' })).resolves.toBeDefined();
+    expect(customerUpdate).toHaveBeenCalledWith({
+      where: { id: 'cust1' },
+      data: { firstName: 'سعید1', lastName: 'اسماعیلی1' },
+    });
+  });
+
+  it('refuses to create an expert on a number a customer holds', async () => {
+    const { service } = build({ id: 'someone-else' });
+    await expect(
+      service.create({ fname: 'علی', lname: 'رضایی', mobile: '09125550000', password: 'secret1', role: 'SALES_EXPERT' }),
+    ).rejects.toThrow('این شماره موبایل قبلاً برای یک مشتری ثبت شده است');
+  });
+
   it('writes nothing to the trading account when nothing it mirrors changed', async () => {
     const { service, customerUpdate } = build();
     await service.update('exp1', { address: 'تهران' });

apps/api/src/modules/admin-users/admin-users.service.ts

@@ -8,6 +8,7 @@ import type { TableQueryDto } from '../admin-table/table-query.dto';
 import { faToEn } from '../customer-auth/digits';
 import { ALL_RIDS } from '../auth/acl.constants';
 import { SUPER_ADMIN_MOBILE, isSuperAdmin } from '../auth/super-admin';
+import { CUSTOMER_HOLDS_MOBILE, customerHoldsMobile } from '../../common/mobile-owner';
 
 /**
  * SEC-07: the rids a role may hold — every rid in the catalogue and each of
@@ -300,6 +301,10 @@ export class AdminUsersService {
     // Unique within the expert table only: the same number may also be an admin.
     const existing = await this.prisma.adminUser.findUnique({ where: { mobile } });
     if (existing) throw new BadRequestException('این شماره موبایل قبلاً ثبت شده است');
+    // ...and a customer signs in to the same apps with theirs: one mobile, one person.
+    if (await customerHoldsMobile(this.prisma, mobile)) {
+      throw new BadRequestException(CUSTOMER_HOLDS_MOBILE);
+    }
 
     return this.prisma.adminUser.create({
       data: {
@@ -456,6 +461,12 @@ export class AdminUsersService {
       if (mobile !== existing.mobile) {
         const clash = await this.prisma.adminUser.findUnique({ where: { mobile } });
         if (clash) throw new BadRequestException('این شماره موبایل قبلاً ثبت شده است');
+        // Only a CHANGED number is asked about, so an expert who already shares
+        // theirs with a customer (older data) stays editable. Their own trading
+        // account may hold it.
+        if (await customerHoldsMobile(this.prisma, mobile, existing.salesExpertProfile?.tradingCustomerId)) {
+          throw new BadRequestException(CUSTOMER_HOLDS_MOBILE);
+        }
       }
       patch.mobile = mobile;
     }