feat(loyalty): customer PIN

Adds the 6-digit customer PIN that approves every action moving EnakPoint
or EnakCoin on the customer's request (docs/prd-point-coin.md K8, F11, Q16,
Q17, PC-301).

Migration 000093 adds the PIN columns to customers and the
customer_security_events table. PIN data is read and written only through
CustomerPinRepository, never the Customer entity, so the hash cannot reach
a customer response. Only a bcrypt hash is stored.

- /customer/pin: status, OTP (pin_setup, pin_reset), create, change,
  reset. The OTP must be for that purpose and sent to the customer's own
  number; the existing OTP validation checks neither. A new PIN is checked
  (6 digits, confirmed, not one digit, not a run up or down, not the birth
  date as DDMMYY or YYMMDD) before the OTP is spent.
- Five wrong attempts in a row lock the PIN for 30 minutes; the counter is
  incremented in one statement so attempts at the same time all count,
  and a lock that ran out starts a new series. A locked PIN is refused even
  when right. The customer is told by WhatsApp, as there is no push channel
  to customers yet; only the attempt that reached the limit alerts.
- A reset through OTP lifts the lock and holds outgoing transfers for 24
  hours; paying and exchanging still work, and a held transfer costs no
  attempt.
- VerifyPin(ctx, customer, pin, action) for the flows that follow, with
  PIN_NOT_SET, PIN_INVALID (attempts left), PIN_LOCKED and
  TRANSFER_BLOCKED (until when), which PinErrorResponse turns into
  distinct codes and statuses.
- DELETE /marketing/customers/:id/pin (loyalty managers, reason required)
  and GET /marketing/customers/:id/security-events, scoped to the
  organization.

Every PIN event is in the security log with IP and user agent. No message
or binding error contains a PIN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/000093_add_customer_pin.down.sql

@@ -0,0 +1,9 @@
+DROP TABLE IF EXISTS customer_security_events;
+
+ALTER TABLE customers
+    DROP CONSTRAINT IF EXISTS chk_customers_pin_failed_attempts,
+    DROP COLUMN IF EXISTS transfer_blocked_until,
+    DROP COLUMN IF EXISTS pin_locked_until,
+    DROP COLUMN IF EXISTS pin_failed_attempts,
+    DROP COLUMN IF EXISTS pin_set_at,
+    DROP COLUMN IF EXISTS pin_hash;

migrations/000093_add_customer_pin.up.sql

@@ -0,0 +1,32 @@
+-- Customer PIN (docs/prd-point-coin.md F11, K8). A 6-digit PIN, separate from the
+-- login password, approves everything that moves EnakPoint or EnakCoin on the
+-- customer's request. Only its bcrypt hash is stored.
+ALTER TABLE customers
+    ADD COLUMN pin_hash               VARCHAR(255),
+    ADD COLUMN pin_set_at             TIMESTAMP WITH TIME ZONE,
+    -- Kept in the database, not a cache, so it cannot be dodged by waiting for a cache
+    -- to expire or by hitting another server (Q17).
+    ADD COLUMN pin_failed_attempts    INT NOT NULL DEFAULT 0,
+    ADD COLUMN pin_locked_until       TIMESTAMP WITH TIME ZONE,
+    -- Outgoing transfers are held for 24 hours after a PIN reset (Q16).
+    ADD COLUMN transfer_blocked_until TIMESTAMP WITH TIME ZONE,
+    ADD CONSTRAINT chk_customers_pin_failed_attempts CHECK (pin_failed_attempts >= 0);
+
+-- Security log of PIN events. Not a balance movement, so not in wallet_transactions.
+CREATE TABLE customer_security_events (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    customer_id UUID NOT NULL REFERENCES customers(id) ON DELETE RESTRICT,
+    -- PIN_SET, PIN_CHANGED, PIN_RESET, PIN_FAILED, PIN_LOCKED, PIN_REMOVED_BY_ADMIN
+    event VARCHAR(30) NOT NULL,
+    -- The admin, for PIN_REMOVED_BY_ADMIN.
+    actor_user UUID,
+    reason VARCHAR(255),
+    ip_address VARCHAR(45),
+    user_agent VARCHAR(255),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+
+    CONSTRAINT chk_customer_security_events_admin CHECK (
+        event <> 'PIN_REMOVED_BY_ADMIN' OR (actor_user IS NOT NULL AND reason IS NOT NULL))
+);
+
+CREATE INDEX idx_customer_security_events_customer_id_created_at ON customer_security_events(customer_id, created_at DESC);