feat(customers): store customer phone numbers as 62…

A customer's phone number (customers.phone_number, the one they log in with) has
one stored form, 62 followed by the number without its 0: 6281234561234.
util.NormalizePhoneNumber rewrites 0812…, +62 812…, 62812…, 812… and +62 0812…,
with spaces, dashes, dots or parentheses, to it, and refuses anything that is not
an Indonesian mobile number (628 and 7 to 11 more digits).

It is applied wherever a customer types their number: check-phone, register,
login and resend-OTP (the validator rewrites the request), and the transfer
recipient. Before, the number was matched as typed and a leading 0 was refused,
so the same customer written another way was not found. The masked recipient
stays 08**-****-1234 as customers write numbers.

Migration 000116 rewrites the numbers already stored in customers and
otp_sessions. When several become the same number, the customer that already has
it keeps it, else a registered one, else the oldest; the others, and numbers that
are not Indonesian mobile numbers, are left as they are and cannot log in until
fixed by hand (the query to find them is in the migration). Down does nothing.

The migration was run, twice, against Postgres with a reduced customers and
otp_sessions schema and sample numbers; not against the real schema. The
Postgres tests were not run. customers.phone (the POS contact number) is not
touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/util/phone.go

@@ -0,0 +1,41 @@
+package util
+
+import (
+	"errors"
+	"regexp"
+	"strings"
+)
+
+// ErrInvalidPhoneNumber means a phone number is not an Indonesian mobile number.
+var ErrInvalidPhoneNumber = errors.New("invalid phone number format")
+
+// customerPhonePattern is an Indonesian mobile number in its stored form: 62, then the
+// number without its leading 0 (628…, 10 to 14 digits in all).
+var customerPhonePattern = regexp.MustCompile(`^628\d{7,11}$`)
+
+// NormalizePhoneNumber turns a customer's phone number into the one form it is stored
+// and looked up in, 62…: "0812-3456-1234", "+62 812 3456 1234", "62812…" and "812…"
+// all become "6281234561234". Spaces, dashes, dots and parentheses are dropped.
+func NormalizePhoneNumber(raw string) (string, error) {
+	digits := strings.Map(func(r rune) rune {
+		switch r {
+		case ' ', '-', '.', '(', ')':
+			return -1
+		}
+		return r
+	}, strings.TrimSpace(raw))
+	digits = strings.TrimPrefix(digits, "+")
+	switch {
+	case strings.HasPrefix(digits, "620"):
+		// +62 typed in front of a number that kept its 0.
+		digits = "62" + digits[3:]
+	case strings.HasPrefix(digits, "0"):
+		digits = "62" + digits[1:]
+	case strings.HasPrefix(digits, "8"):
+		digits = "62" + digits
+	}
+	if !customerPhonePattern.MatchString(digits) {
+		return "", ErrInvalidPhoneNumber
+	}
+	return digits, nil
+}