parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR

Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.

Customer JWT, separate from the admin one (T1):
  - new src/modules/customer-auth/ with its own passport strategy,
    CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
  - signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
    which the strategy verifies; both checks are present deliberately
  - customer state re-read per request, so deactivating takes effect at once
  - mirrors the reference's own split: auth:api vs auth('api-customer')

Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
  - new CustomerOtp table, additive migration, nothing existing touched
  - parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
    normalisation on both number and code, rejection on mismatch
  - approved improvements over the reference: bcrypt-hashed code, 2-minute
    expiry, 5 attempts then lockout, single use, send throttle (60s per
    number, 5/number and 20/IP per 10 min), and no number enumeration

Routes removed, replaced by token-derived equivalents:
  GET customers, customers/:id, /:id/orders, /:id/ledger-entries
    -> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).

Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.

Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.

[ref: henza_server ApiMobileController.php:39-78]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/modules/customer-auth/customer-jwt.strategy.ts

@@ -0,0 +1,61 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { PrismaService } from '../../prisma/prisma.service';
+import { customerJwtSecret } from './customer-auth.service';
+
+/**
+ * Marks a token as a customer token. Checked on every customer route, so an
+ * admin token — even one signed with the same secret by misconfiguration —
+ * cannot be used to read customer data (T1).
+ */
+export const CUSTOMER_TOKEN_TYPE = 'customer' as const;
+
+export interface CustomerJwtPayload {
+  sub: string;
+  mobile: string;
+  typ: typeof CUSTOMER_TOKEN_TYPE;
+}
+
+/** What `@CurrentCustomer()` hands a handler. */
+export interface AuthenticatedCustomer {
+  id: string;
+  mobile: string;
+}
+
+/**
+ * The customer principal, kept entirely separate from JwtStrategy (which reads
+ * AdminUser). The reference had the same split: `auth:api` for admins and
+ * `auth('api-customer')` for the app.
+ */
+@Injectable()
+export class CustomerJwtStrategy extends PassportStrategy(Strategy, 'customer-jwt') {
+  constructor(private readonly prisma: PrismaService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: customerJwtSecret(),
+    });
+  }
+
+  async validate(payload: CustomerJwtPayload): Promise<AuthenticatedCustomer> {
+    // A token that is not explicitly a customer token is refused, whatever else
+    // it carries.
+    if (payload?.typ !== CUSTOMER_TOKEN_TYPE) {
+      throw new UnauthorizedException();
+    }
+
+    // Re-read on every request, so deactivating or archiving a customer takes
+    // effect immediately instead of at token expiry.
+    const customer = await this.prisma.customer.findUnique({
+      where: { id: payload.sub },
+      select: { id: true, mobile: true, isActive: true, isArchived: true },
+    });
+
+    if (!customer || !customer.isActive || customer.isArchived) {
+      throw new UnauthorizedException();
+    }
+
+    return { id: customer.id, mobile: customer.mobile };
+  }
+}