parity(api,apps): close SEC-02 - orders take the customer from the token

The user declined to defer this to Phase 2, correctly: a public POST /orders
with customerId in the body let anyone place an order on any customer's
account, and an order lands on that customer's gold debt and ledger.

POST /orders is now behind CustomerAuth. OrdersService.createOrder takes the
customer id as a separate argument that the controller fills from the token;
the body's customerId is ignored and a mismatch is logged. The field stays
optional in the DTO and in shared-types only so both apps keep validating
while they still send it -- they drop it in Phase 2. The admin builder is
unaffected: it legitimately places orders for a chosen customer and passes
that id explicitly, behind the admin guard.

GET /orders/:id is scoped to the owner. A foreign or nonexistent id both
return 404, never 403, so ids stay unenumerable. Operators read through the
new GET /orders/admin/:id behind rid order.list, declared before the :id
route because Nest matches in declaration order.

Both apps' CartView now gates on session.isLoggedIn rather than a remembered
customerId, which is no longer a credential.

OTP audit (requested): no master code, no bypass, no hardcoded code anywhere;
one code path issues a token and only after bcrypt.compare. No SMS provider is
wired up -- in development the code is logged once, guarded by
NODE_ENV !== 'production'.

Fixed while auditing (SEC-11): deliver() persisted the real message text, code
included, into SmsMessage.body, which the admin SMS grid lists and full-text
searches. Any operator with the sms rid could read live codes, defeating the
hashing of codeHash. The stored row is now a redacted audit line.

Also logged MON-08: wagePercent/discountPercent/flatRialCharge are still taken
from the client on order creation. The reference is worse -- it takes
rash_weight from the client too -- so this is already a partial improvement;
logged rather than changed, per D4.

Tests: auth-smoke.sh now 53 passed, 0 failed, including a spoofed body
customerId being ignored in favour of the token. Typecheck clean on api,
user-app, user-app-v2 and shared-types.

[ref: henza_server ApiMobileController.php:533,536-545,615-632]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/modules/customer-auth/customer-auth.service.ts

@@ -213,21 +213,31 @@ export class CustomerAuthService {
    * (ApiMobileController.php:47).
    */
   private async deliver(mobile: string, code: string) {
-    const body =
+    // The exact text the reference sent (ApiMobileController.php:47), kept for
+    // whenever a gateway is wired up. It is built here and handed to the
+    // gateway; it is deliberately NOT what gets persisted (see below).
+    const smsText =
       `<#> code is ${code}\n` +
       `رمز عبور یکبار مصرف شما جهت ورود به اپلیکشن هنزا گلد ${code} می باشد\n` +
       `aMo6iFyUQaY`;
+    void smsText; // TODO: hand to the SMS provider once one exists (STUB-02)
 
     if (process.env.NODE_ENV !== 'production') {
       this.logger.log(`[dev] OTP for ${mobile}: ${code}`);
     }
 
-    // Recorded the same way the admin panel's own SMS sends are.
+    // An audit row, NOT the message body.
+    //
+    // SmsMessage.body is listed and full-text searchable on the admin panel's
+    // SMS grid (admin-misc.service.ts:136 allows `body`, :135 searches it), so
+    // persisting the real text would show every live OTP to any operator
+    // holding the `sms` rid — and the whole point of hashing codeHash is that
+    // the code exists nowhere in readable form. The code is redacted here.
     await this.prisma.smsMessage.create({
       data: {
         audience: MessageAudience.SINGLE_NUMBER,
         recipients: mobile,
-        body,
+        body: 'کد یکبار مصرف ورود (متن پیام ثبت نمی‌شود)',
         sentCount: 1,
       },
     });