Fix admin IAM redirect and separate pending wholesale lists.

Keep admin browser bootstrap from falling back to the customer app URL, and exclude activated customers from the pending-verification list so it no longer mirrors the main omde grid.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/modules/iam/iam.service.spec.ts

@@ -211,4 +211,44 @@ describe('IamService', () => {
       IamUnavailableError,
     );
   });
+
+  /* ─────────────── browser return / bootstrap ─────────────── */
+
+  it('sends admin return_to, never the customer app URL', async () => {
+    configure({
+      IAM_BROWSER_RETURN_URL: 'https://app-v2.example/home',
+      IAM_ADMIN_BROWSER_RETURN_URL: 'https://admin.example/',
+    });
+    respondWith(200, { status: 'SUCCESS', user: { id: 'sub-1' } });
+
+    await service.verifyCredentials('09120000000', 'secret');
+
+    const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
+    expect(body.return_to).toBe('https://admin.example/');
+  });
+
+  it('omits return_to when admin return is unset, even if customer return is set', async () => {
+    configure({ IAM_BROWSER_RETURN_URL: 'https://app-v2.example/home' });
+    delete process.env.IAM_ADMIN_BROWSER_RETURN_URL;
+    delete process.env.IAM_ADMIN_POST_LOGOUT_REDIRECT_URI;
+    delete process.env.IAM_ADMIN_ALLOWED_RETURN_URLS;
+    respondWith(200, { status: 'SUCCESS', user: { id: 'sub-1' } });
+
+    await service.verifyCredentials('09120000000', 'secret');
+
+    const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
+    expect(body.return_to).toBeUndefined();
+  });
+
+  it('refuses an admin bootstrap ticket without an admin return URL', () => {
+    configure({ IAM_BROWSER_RETURN_URL: 'https://app-v2.example/home' });
+    delete process.env.IAM_ADMIN_BROWSER_RETURN_URL;
+    delete process.env.IAM_ADMIN_POST_LOGOUT_REDIRECT_URI;
+    delete process.env.IAM_ADMIN_ALLOWED_RETURN_URLS;
+
+    expect(service.browserBootstrapUrl('ticket-1', 'admin')).toBeNull();
+    expect(service.browserBootstrapUrl('ticket-1', 'customer')).toBe(
+      'https://auth.test.local/auth/bootstrap?ticket=ticket-1',
+    );
+  });
 });