feat: interim customer PIN auth (login/set-pin/verify-pin), mirrors miler flow

No SMS/OTP gateway is live yet, so customers sign in with a self-set PIN like
milers do. The OTP endpoints stay in place — the app switches back once a
gateway is plugged in.

- POST /customer/auth/login  {phone} -> {registered, pin_set, name}: routes the
  app to register / set-PIN / enter-PIN.
- POST /customer/auth/set-pin {phone, new_pin, name?}: first-time PIN. Creates
  the account (name required) or sets the first PIN on an account with none;
  refuses to overwrite an existing PIN (409); logs in on success.
- POST /customer/auth/verify-pin {phone, pin}: returning login; same generic
  message for unknown phone and wrong PIN so it can't enumerate accounts.

All three reuse issueCxSession (access + refresh + customer) and the /customer
Cx* response envelope. Build + vet clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WRaFH5hMRqmUQvVPQsyjZD

routes/routes.go

@@ -114,6 +114,14 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
 	customer.Post("/auth/otp/verify", authThrottle, middlewares.Idempotency(), controllers.CxVerifyOtp(cfg))
 	customer.Post("/auth/refresh", authThrottle, controllers.CxRefresh(cfg))
 
+	// Interim PIN auth, until the SMS/OTP gateway is live (see internal/sms).
+	// Same shape as the miler flow: /login reports whether a PIN is set, then the
+	// app routes to /set-pin (first time / new account) or /verify-pin (returning).
+	// set-pin can't overwrite an existing PIN, so it's safe unauthenticated here.
+	customer.Post("/auth/login", authThrottle, controllers.CxPinLogin)
+	customer.Post("/auth/set-pin", authThrottle, controllers.CxSetPin(cfg))
+	customer.Post("/auth/verify-pin", authThrottle, controllers.CxVerifyPin(cfg))
+
 	// Serviceability and configuration are read before sign-in: the booking
 	// form is explorable without an account, and gating the state picker behind
 	// auth would make the app's first screen a login wall.