parity(api,admin): split customer name, add making-charge offset, wire SMS

Applies the two approved additive migrations and fixes every consumer.

D0 — Customer.firstName / lastName
The reference has had two columns since 2020
(2020_10_01_120430_customers_table.php:18-19); the port collapsed them, so
the edit form showed the whole name in the "first name" box and saved an
empty last name. Adds both columns, backfills first-token/rest, and keeps
fullName in sync with a customer_sync_full_name trigger. Nothing dropped.

The trigger is SQL, so Prisma cannot see it: writing the parts rebuilds
fullName, writing fullName re-derives the parts, and writing both in one
statement lets THE PARTS WIN. Documented in the migration header, the
Customer model doc comment and DECISIONS.md §D14, because a write can now
store something other than what was passed.

D9 — Customer.makingChargeOffsetPercent
Legacy customers.percent, the per-customer making-charge offset that the
app adds to the variant's making charge (henza_pwa
Mixins/product/index.ts:69-75). toRow() was returning the referring
AGENT's commission rate instead (CUST-02). DB default 0 reproduces
today's behaviour exactly, so no existing customer's price moves; the
reference's application-layer default of 3 for NEW customers
(AdminController.php:338) lives in the create form, and the field is
required on create with the reference's own message (:354).

update() and updateCredit() both accepted percent and silently discarded
it; both now persist it. Sort/filter aliases fname/lname pointed at
fullName and now point at the real columns.

SMS — Trez provider (Sms.php:57-82)
New global SmsModule/SmsService: form-urlencoded POST, 20s timeout, body
trimmed, every message persisted. send() never throws, matching the
reference, which discarded Sms::Send's result so a gateway outage never
aborted the order or approval that triggered it. The OTP text is
byte-identical, including the Android SMS Retriever markers. Credentials
come from env only; production refuses to boot without them rather than
silently locking every customer out. .env.example carries names, no values.

Admin panel: the split(' ') fallback is removed from singleCustomer.vue,
and bulkCustomer.vue defaults percent to 3, requires it, coerces the
Decimal on load so diff-send works, and only re-sends `name` when a name
part changed. ReagentCustomer.vue is untouched — its «درصد کمیسیون» is
AdminUser.wagePercent, a different field.

Tests: 32 jest (incl. 14 new SMS config/template), 9 trigger assertions,
53 auth smoke, and the full D12 round-trip on the customer entity —
«محمد علی» + «احمدی» survives create, edit, a byte-identical no-op save,
and single-field edits. Typecheck clean on api and admin-panel.

Note: migrate dev is interactive-only and could not run here, so the
migrations were applied with migrate deploy after a read-only drift check.
The only drift is the pre-existing _goldbank_migrations table, which
Prisma would DROP; it was NOT dropped (DEAD-07).

[ref: henza_server/app/Models/Sms.php, app/Http/Controllers/Adm/AdminController.php]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/modules/customer-auth/customer-auth.service.ts

@@ -5,6 +5,7 @@ import * as bcrypt from 'bcryptjs';
 import { PrismaService } from '../../prisma/prisma.service';
 import { CUSTOMER_TOKEN_TYPE, type CustomerJwtPayload } from './customer-jwt.strategy';
 import { faToEn } from './digits';
+import { SmsService, smsConfigured } from '../sms/sms.service';
 
 /** Nest 10 has no TooManyRequestsException; 429 with a Persian message. */
 class TooManyRequestsException extends HttpException {
@@ -32,6 +33,7 @@ export class CustomerAuthService {
   constructor(
     private readonly prisma: PrismaService,
     private readonly jwt: JwtService,
+    private readonly sms: SmsService,
   ) {}
 
   /**
@@ -201,28 +203,34 @@ export class CustomerAuthService {
   }
 
   /**
-   * Hands the code to the SMS gateway.
+   * Hands the code to the SMS gateway (SmsService -> Trez, per Sms.php:57-82).
    *
-   * No gateway is wired up in this project yet — SmsMessage is persistence only
-   * (logged as STUB-02 in docs/parity/ISSUES.md), exactly as the reference's
-   * Sms::Send would have been the integration point. Until one is connected the
-   * code is logged, and only outside production, so a deployment cannot print
-   * live codes into its logs.
+   * When no credentials are configured, SmsService does not send and the code
+   * is logged instead — development only; production refuses to boot without
+   * credentials (assertSmsConfigured in main.ts).
    *
-   * The reference's message text is kept verbatim for when the gateway lands
-   * (ApiMobileController.php:47).
+   * A failed send does NOT throw. The reference ignored Sms::Send's result, so
+   * a gateway outage never blocked the flow that triggered it; the customer
+   * simply retries, and the throttle in assertSendAllowed still applies.
    */
   private async deliver(mobile: string, code: string) {
-    // The exact text the reference sent (ApiMobileController.php:47), kept for
-    // whenever a gateway is wired up. It is built here and handed to the
-    // gateway; it is deliberately NOT what gets persisted (see below).
+    // BYTE-IDENTICAL to the reference (ApiMobileController.php:47). The
+    // leading "<#> code is <CODE>" line and the trailing "aMo6iFyUQaY" are the
+    // Android SMS Retriever app hash — change either and autofill stops
+    // working on every installed client. Do not "tidy" this string.
     const smsText =
       `<#> code is ${code}\n` +
       `رمز عبور یکبار مصرف شما جهت ورود به اپلیکشن هنزا گلد ${code} می باشد\n` +
       `aMo6iFyUQaY`;
-    void smsText; // TODO: hand to the SMS provider once one exists (STUB-02)
 
-    if (process.env.NODE_ENV !== 'production') {
+    // persist:false — the real text carries the live code, and the admin SMS
+    // grid lists and searches `body` (SEC-11). The redacted audit row below
+    // takes its place.
+    await this.sms.send(mobile, smsText, { persist: false });
+
+    // Only outside production, and only when no gateway is configured, so a
+    // deployment can never print live codes into its logs.
+    if (process.env.NODE_ENV !== 'production' && !smsConfigured()) {
       this.logger.log(`[dev] OTP for ${mobile}: ${code}`);
     }