parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR

Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.

Customer JWT, separate from the admin one (T1):
  - new src/modules/customer-auth/ with its own passport strategy,
    CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
  - signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
    which the strategy verifies; both checks are present deliberately
  - customer state re-read per request, so deactivating takes effect at once
  - mirrors the reference's own split: auth:api vs auth('api-customer')

Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
  - new CustomerOtp table, additive migration, nothing existing touched
  - parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
    normalisation on both number and code, rejection on mismatch
  - approved improvements over the reference: bcrypt-hashed code, 2-minute
    expiry, 5 attempts then lockout, single use, send throttle (60s per
    number, 5/number and 20/IP per 10 min), and no number enumeration

Routes removed, replaced by token-derived equivalents:
  GET customers, customers/:id, /:id/orders, /:id/ledger-entries
    -> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).

Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.

Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.

[ref: henza_server ApiMobileController.php:39-78]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/prisma/schema.prisma

@@ -233,6 +233,7 @@ model Customer {
   promotions    Promotion[]
   notifications NotificationRecipient[]
   activityLogs  CustomerActivityLog[]
+  otpChallenges CustomerOtp[]
 
   @@index([referredByAgentId])
 }
@@ -909,3 +910,43 @@ model UploadedFile {
 
   @@index([purpose])
 }
+
+/// One OTP login challenge for a customer.
+///
+/// Ports henza_server's flow (ApiMobileController.php:39-78), where userAuth
+/// generated rand(1000,9999), stored it on the customer row as `send_password`
+/// and sent it by SMS, and userVerfiy compared the submitted code against it
+/// (mismatch -> HTTP 422).
+///
+/// Three deliberate improvements over the reference, approved by the user
+/// (docs/parity/DECISIONS.md D6 and T1):
+///   1. the code is stored as a bcrypt hash, never in plain text — the
+///      reference kept it readable in a customer column;
+///   2. it expires (`expiresAt`) — the reference's code stayed valid forever;
+///   3. attempts are counted and the challenge locks out — the reference had
+///      no limit at all.
+/// The parity behaviour itself is the code comparison and the rejection.
+model CustomerOtp {
+  id         String   @id @default(cuid())
+  /// Normalised to English digits before storing, as the reference does with
+  /// Utility::faTOen() on both send and verify.
+  mobile     String
+  customerId String
+  customer   Customer @relation(fields: [customerId], references: [id], onDelete: Cascade)
+
+  /// bcrypt hash of the 4-digit code. Never the code itself.
+  codeHash String
+  expiresAt DateTime
+  /// Failed verify attempts against THIS challenge.
+  attempts Int      @default(0)
+  /// Set when the code is accepted, so one challenge cannot be reused.
+  consumedAt DateTime?
+
+  /// Kept for the per-IP send throttle.
+  requestIp String?
+  createdAt DateTime @default(now())
+
+  @@index([mobile, createdAt])
+  @@index([customerId])
+  @@index([expiresAt])
+}