feat(loyalty): customer PIN

Adds the 6-digit customer PIN that approves every action moving EnakPoint
or EnakCoin on the customer's request (docs/prd-point-coin.md K8, F11, Q16,
Q17, PC-301).

Migration 000093 adds the PIN columns to customers and the
customer_security_events table. PIN data is read and written only through
CustomerPinRepository, never the Customer entity, so the hash cannot reach
a customer response. Only a bcrypt hash is stored.

- /customer/pin: status, OTP (pin_setup, pin_reset), create, change,
  reset. The OTP must be for that purpose and sent to the customer's own
  number; the existing OTP validation checks neither. A new PIN is checked
  (6 digits, confirmed, not one digit, not a run up or down, not the birth
  date as DDMMYY or YYMMDD) before the OTP is spent.
- Five wrong attempts in a row lock the PIN for 30 minutes; the counter is
  incremented in one statement so attempts at the same time all count,
  and a lock that ran out starts a new series. A locked PIN is refused even
  when right. The customer is told by WhatsApp, as there is no push channel
  to customers yet; only the attempt that reached the limit alerts.
- A reset through OTP lifts the lock and holds outgoing transfers for 24
  hours; paying and exchanging still work, and a held transfer costs no
  attempt.
- VerifyPin(ctx, customer, pin, action) for the flows that follow, with
  PIN_NOT_SET, PIN_INVALID (attempts left), PIN_LOCKED and
  TRANSFER_BLOCKED (until when), which PinErrorResponse turns into
  distinct codes and statuses.
- DELETE /marketing/customers/:id/pin (loyalty managers, reason required)
  and GET /marketing/customers/:id/security-events, scoped to the
  organization.

Every PIN event is in the security log with IP and user agent. No message
or binding error contains a PIN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/service/customer_pin_service_test.go

@@ -0,0 +1,50 @@
+package service
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"apskel-pos-be/internal/processor"
+	"apskel-pos-be/internal/repository"
+	"apskel-pos-be/internal/util"
+)
+
+func TestPinErrorResponse(t *testing.T) {
+	until := time.Date(2026, 9, 30, 12, 30, 0, 0, time.UTC)
+	for name, c := range map[string]struct {
+		err    error
+		code   string
+		status int
+		data   map[string]interface{}
+	}{
+		"not set":  {&processor.PinError{Code: processor.PinErrNotSet}, "PIN_NOT_SET", http.StatusForbidden, map[string]interface{}{"code": "PIN_NOT_SET"}},
+		"invalid":  {fmt.Errorf("pay: %w", &processor.PinError{Code: processor.PinErrInvalid, RemainingAttempts: 2}), "PIN_INVALID", http.StatusBadRequest, map[string]interface{}{"code": "PIN_INVALID", "remaining_attempts": 2}},
+		"locked":   {&processor.PinError{Code: processor.PinErrLocked, Until: &until}, "PIN_LOCKED", http.StatusLocked, map[string]interface{}{"code": "PIN_LOCKED", "locked_until": &until}},
+		"transfer": {&processor.PinError{Code: processor.PinErrTransferBlocked, Until: &until}, "TRANSFER_BLOCKED", http.StatusForbidden, map[string]interface{}{"code": "TRANSFER_BLOCKED", "transfer_blocked_until": &until}},
+	} {
+		resp := PinErrorResponse(c.err)
+		assert.False(t, resp.Success, name)
+		assert.Equal(t, c.code, resp.Errors[0].Code, name)
+		assert.Equal(t, c.status, util.MapErrorCodeToHttpStatus(resp.Errors[0].Code), name)
+		assert.Equal(t, c.data, resp.Data, name)
+	}
+
+	for name, c := range map[string]struct {
+		err    error
+		status int
+	}{
+		"weak PIN":      {fmt.Errorf("%w: too easy", processor.ErrInvalidPinInput), http.StatusBadRequest},
+		"bad OTP":       {processor.ErrPinOtpInvalid, http.StatusBadRequest},
+		"already set":   {processor.ErrPinAlreadySet, http.StatusBadRequest},
+		"too soon":      {processor.ErrPinOtpTooSoon, http.StatusTooManyRequests},
+		"no customer":   {repository.ErrPinCustomerNotFound, http.StatusNotFound},
+		"anything else": {fmt.Errorf("db down"), http.StatusInternalServerError},
+	} {
+		resp := PinErrorResponse(c.err)
+		assert.Equal(t, c.status, util.MapErrorCodeToHttpStatus(resp.Errors[0].Code), name)
+	}
+}