parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR

Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.

Customer JWT, separate from the admin one (T1):
  - new src/modules/customer-auth/ with its own passport strategy,
    CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
  - signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
    which the strategy verifies; both checks are present deliberately
  - customer state re-read per request, so deactivating takes effect at once
  - mirrors the reference's own split: auth:api vs auth('api-customer')

Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
  - new CustomerOtp table, additive migration, nothing existing touched
  - parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
    normalisation on both number and code, rejection on mismatch
  - approved improvements over the reference: bcrypt-hashed code, 2-minute
    expiry, 5 attempts then lockout, single use, send throttle (60s per
    number, 5/number and 20/IP per 10 min), and no number enumeration

Routes removed, replaced by token-derived equivalents:
  GET customers, customers/:id, /:id/orders, /:id/ledger-entries
    -> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).

Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.

Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.

[ref: henza_server ApiMobileController.php:39-78]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/PROGRESS.md

@@ -7,27 +7,47 @@
 
 | Field | Value |
 |---|---|
-| **Phase** | Security hotfix (out-of-band, authorised by D7/T1–T3) — **stage 1 ✅ done**, stage 2 next |
+| **Phase** | Security hotfix — **stages 1 and 2 ✅ complete** |
 | **Branch** | `parity/security-hotfix` |
-| **Status** | Stage 1 complete and tested live: 23/23 smoke assertions pass. Decisions D0–D12 + T1–T3 recorded. |
-| **Next step** | Stage 2 — customer JWT (`typ` claim, separate secret) + real OTP + migrate both apps' login; then remove `GET /customers` from the public surface |
-| **Blocked on** | nothing for stage 2. Still pending later: D0 migration + `percent` migration must be **shown and approved before running** |
+| **Status** | Both stages done and verified live: **46/46** smoke assertions, **7/7** jest unit tests, typecheck + build clean on all three projects. |
+| **Next step** | Show the user the **D0 (firstName/lastName)** and **`percent`** migrations for approval, then start `01-ADMIN-MATRIX.md` field-by-field (D12) |
+| **Blocked on** | user approval of those two migrations before they run |
 | **Last updated** | 2026-09-22 |
 
-### Security hotfix — stage 1 result
+### Security hotfix — final result
 
-| Route | Was | Now | Rid |
-|---|---|---|---|
-| `GET accounting/customers/:id/balance` | public | admin | `wallet.list` |
-| `POST accounting/customers/:id/reconcile` | public **write** | admin | `wallet.charge` |
-| `POST accounting/repayments/gold` | public **write** | admin | `document.create` |
-| `POST accounting/repayments/rial` | public **write** | admin | `document.create` |
-| `POST accounting/entries/:id/confirm` | public **write** | admin | `document.list.confirm` |
-| `PATCH orders/:id/status` | public **write** | admin | `order.list.sts.submit` |
-| `GET customers` | 18 fields incl. national ID, debts, doc URLs | 4 fields | still public until stage 2 |
+| Route | Was | Now |
+|---|---|---|
+| `GET accounting/customers/:id/balance` | public | admin, rid `wallet.list` |
+| `POST accounting/customers/:id/reconcile` | public **write** | admin, rid `wallet.charge` |
+| `POST accounting/repayments/gold` | public **write** | admin, rid `document.create` |
+| `POST accounting/repayments/rial` | public **write** | admin, rid `document.create` |
+| `POST accounting/entries/:id/confirm` | public **write** | admin, rid `document.list.confirm` |
+| `PATCH orders/:id/status` | public **write** | admin, rid `order.list.sts.submit` |
+| `GET customers` | every customer, 18 fields | **route deleted** |
+| `GET customers/:id` | public | **route deleted** → `GET customer/me` (token) |
+| `GET customers/:id/orders` | public | **route deleted** → `GET customer/me/orders` (token) |
+| `GET customers/:id/ledger-entries` | public | **route deleted** → `GET customer/me/ledger-entries` (token) |
+| — | — | **new** `POST customer/auth/request-otp` · `verify-otp` |
 
-Test: `apps/api/scripts/auth-smoke.sh` — **23 passed, 0 failed**.
-Typecheck: api ✅ · user-app ✅ · user-app-v2 ✅.
+Still public by design: `catalog/products`, `pricing/latest`, `home/slider`,
+`uploads/:filename` (ruling T2), and `POST /orders` + `GET /orders/:id` — the
+last two are logged as SEC-02/B1-B2 and want a customer-token pass of their own.
+
+**Tests**
+- `apps/api/scripts/auth-smoke.sh` (live server): **46 passed, 0 failed**.
+  Run it with `API=http://localhost:3000/api CODE_LOG=/path/to/api.log`.
+- `pnpm test` in `apps/api` (jest, newly installed): **7 passed**.
+- Typecheck: api ✅ · user-app ✅ · user-app-v2 ✅. Both apps build ✅.
+
+### ⚠️ Correction worth remembering
+
+Stage 1 reported the customer-book leak as "mitigated" after narrowing the
+`GET /customers` field list. That was wrong: the response still returned every
+customer **id**, and the three `/customers/:id*` routes were still public, so the
+full data was still two requests away. The user caught it. Stage 2 deleted the
+whole id-bearing surface instead. **Narrowing a response is not closing a leak
+while the id and the id-addressed routes remain.**
 
 ## ⚠️ Read `DECISIONS.md` before doing anything