Revert "updates on the otp updates on the customer app"

This reverts commit 89321c9e06.

docs/CHANGELOG.md

@@ -4,73 +4,6 @@ This document provides a comprehensive log of the major features, architectural
 
 ---
 
-## 0. Customer sign-in fix, config hardening & admin ordering (2026-09-11)
-
-Six defects were reported against customer bookings. Five were real, one was
-not. Full detail in `CLAUDE.md` §8.6.
-
-**Fixed**
-
-- **`POST /customer/auth/otp/verify` now accepts `otp` as well as `code`.**
-  The handler only ever read `code`; the app sent `otp`, because this repo's
-  own quick-reference documented `otp` while `openapi-customer.yaml` said
-  `code`. Every sign-in failed with a `400` — a correct code failed exactly
-  like a wrong one. `code` remains the contract and wins when both are sent;
-  `otp` is a deprecated alias kept so builds already installed keep working.
-- **A failed OTP send no longer leaves a live code behind.** `issueCxOtp` now
-  rolls back the stored code, the resend cooldown and the rate-limit slot when
-  SMS or email delivery fails, instead of charging the customer for the
-  gateway's failure.
-- **`GET /admin/bookings` is ordered `bookingid DESC`.** It had no `ORDER BY`,
-  so row order was unspecified — in practice oldest first, putting the newest
-  booking on the last page and outside any client that reads a bounded number
-  of pages. `OFFSET` paging over an unordered result was also unstable.
-- **Production hosts and credentials removed from `config.Load()` defaults.**
-  `JWT_SECRET_KEY`, `NATS_URL`/`NATS_USER`/`NATS_PASSWORD`,
-  `AI_LAYER_BASE_URL`, `ROUTE_OPTIMIZER_URL` and `DB_PASSWORD` all defaulted to
-  real values, so a clone of this repo could mint a valid token for any account
-  and any local run joined the live NATS stream. A second hardcoded production
-  URL in `internal/assignment/ai_layer.go` was removed too.
-
-**Behaviour change to be aware of when deploying**
-
-`cfg.Validate()` now runs at startup and **the service refuses to boot when
-`JWT_SECRET_KEY` is unset and `ENV=production`**. Outside production an
-ephemeral per-process key is generated with a warning, so local development
-needs no configuration — but tokens no longer survive a restart unless you set
-the variable. Make sure `JWT_SECRET_KEY` is present in the production
-environment before the next deploy.
-
-Unset `NATS_URL` now means "no NATS" rather than "production NATS": publishes
-are dropped and no consumer starts. Set it explicitly wherever NATS is wanted.
-
-**Investigated and rejected**
-
-A reported +5:30 timestamp drift (`DBNow()` vs `timestamp with time zone`
-columns) does **not** exist on production — the columns there are `timestamp
-without time zone`, which is what `DBNow()` assumes, confirmed by a round-trip
-with zero drift. Changing `DBNow()` would introduce the bug. The real risk is
-that GORM's `AutoMigrate` produces `timestamptz`, so a freshly built schema
-does not match production and every new dev environment shows a drift that
-production does not.
-
-**Docs corrected**
-
-`customer-app-api-crisp.md` carried three request shapes that did not match
-their parsers (`auth/otp/verify`, `fare/estimate`, `bookings`) plus a wrong
-booking response shape; `express-console-api.md` documented pagination as
-"default 500, cap 1000" when the code enforces default 20, cap 100. Every one
-of these failed silently through `BodyParser` or a page budget, never as an
-error.
-
-**Still open**
-
-Email OTP returns 500 on production (`SMTP_*` unset); `.env` and a live GCP
-service-account key remain committed and need rotating; `GET /api/v1/ready`
-returns 503 with a body that says `"status":"ready"`.
-
----
-
 ## 1. Customer App v1 API Rebuild (`doormile_cx`)
 
 The customer-facing surface was completely rebuilt from the legacy single-destination / PIN-based flow to the production Customer App v1 contract.