parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR

Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.

Customer JWT, separate from the admin one (T1):
  - new src/modules/customer-auth/ with its own passport strategy,
    CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
  - signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
    which the strategy verifies; both checks are present deliberately
  - customer state re-read per request, so deactivating takes effect at once
  - mirrors the reference's own split: auth:api vs auth('api-customer')

Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
  - new CustomerOtp table, additive migration, nothing existing touched
  - parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
    normalisation on both number and code, rejection on mismatch
  - approved improvements over the reference: bcrypt-hashed code, 2-minute
    expiry, 5 attempts then lockout, single use, send throttle (60s per
    number, 5/number and 20/IP per 10 min), and no number enumeration

Routes removed, replaced by token-derived equivalents:
  GET customers, customers/:id, /:id/orders, /:id/ledger-entries
    -> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).

Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.

Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.

[ref: henza_server ApiMobileController.php:39-78]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/DECISIONS.md

@@ -421,3 +421,41 @@ and returned **only that one customer** after the code matched. There was no
 lookup. **D6 (real OTP) is the fix for both problems at once** — once
 `POST auth/otp/verify` returns the authenticated customer, `GET /customers` can
 be taken off the public surface entirely.
+
+---
+
+# Stage 2 implementation record (2026-09-22)
+
+## Deliberate improvements over the reference — user-approved
+
+Recorded here so the Phase 1/2 matrices do not later flag them as parity gaps.
+
+| # | Behaviour | Reference | Target | Approved in |
+|---|---|---|---|---|
+| 1 | OTP storage | plain text in `customer.send_password` | bcrypt hash in `CustomerOtp.codeHash` | D6 |
+| 2 | OTP expiry | none — valid forever | 2 minutes | D6 |
+| 3 | Attempt limit | none | 5 per challenge, then lockout | D6 |
+| 4 | Replay | code stayed usable | single use (`consumedAt`) | D6 |
+| 5 | Send throttle | none | 60s cooldown/number, 5 per number and 20 per IP per 10 min | user message of 2026-09-22 |
+| 6 | Unknown number | `firstOrFail()` → 404, enumerable | identical `{sent:true}` | implied by 5; recorded here |
+| 7 | Token rotation | `api_token` issued once, reused forever | fresh token on every verify | T1 |
+| 8 | Token expiry | none | `JWT_CUSTOMER_EXPIRES_IN`, default 30d | T1 |
+| 9 | Token secret | single opaque string | `JWT_CUSTOMER_SECRET`, separate from admin, plus a `typ` claim | T1 |
+
+## New environment variables
+
+| Name | Default | Purpose |
+|---|---|---|
+| `JWT_CUSTOMER_SECRET` | falls back to `JWT_SECRET`, then a dev string | signs customer tokens |
+| `JWT_CUSTOMER_EXPIRES_IN` | `30d` | customer token lifetime |
+
+Both fall back so local development keeps working, and both inherit the SEC-04
+problem (an insecure default when unset) — tracked there, not re-logged.
+
+## Known gap left open on purpose
+
+`POST /orders` and `GET /orders/:id` are still `@Public()`. The customer token
+now exists, so they can be closed, but `CreateOrderDto` carries `customerId` in
+the body and changing that is an API-contract change touching both apps' cart
+flow. Left for the Phase 2 apps work rather than widened into this hotfix.
+Tracked as SEC-02 (B1/B2) in `ISSUES.md`.