feat(api): complete unified v2 mobile surface

backend/unified-api/src/routes/auth.js

@@ -1,14 +1,29 @@
 import express from 'express';
 import { AppError } from '../lib/errors.js';
-import { parseClientSignIn, parseClientSignUp, signInClient, signOutActor, signUpClient, getSessionForActor } from '../services/auth-service.js';
+import {
+  getSessionForActor,
+  parseClientSignIn,
+  parseClientSignUp,
+  parseStaffPhoneStart,
+  parseStaffPhoneVerify,
+  signInClient,
+  signOutActor,
+  signUpClient,
+  startStaffPhoneAuth,
+  verifyStaffPhoneAuth,
+} from '../services/auth-service.js';
 import { verifyFirebaseToken } from '../services/firebase-auth.js';
 
 const defaultAuthService = {
   parseClientSignIn,
   parseClientSignUp,
+  parseStaffPhoneStart,
+  parseStaffPhoneVerify,
   signInClient,
   signOutActor,
   signUpClient,
+  startStaffPhoneAuth,
+  verifyStaffPhoneAuth,
   getSessionForActor,
 };
 
@@ -31,7 +46,7 @@ async function requireAuth(req, _res, next) {
       return next();
     }
 
-    const decoded = await verifyFirebaseToken(token, { checkRevoked: true });
+    const decoded = await verifyFirebaseToken(token);
     req.actor = {
       uid: decoded.uid,
       email: decoded.email || null,
@@ -77,6 +92,32 @@ export function createAuthRouter(options = {}) {
     }
   });
 
+  router.post('/staff/phone/start', async (req, res, next) => {
+    try {
+      const payload = authService.parseStaffPhoneStart(req.body);
+      const result = await authService.startStaffPhoneAuth(payload, { fetchImpl });
+      return res.status(200).json({
+        ...result,
+        requestId: req.requestId,
+      });
+    } catch (error) {
+      return next(error);
+    }
+  });
+
+  router.post('/staff/phone/verify', async (req, res, next) => {
+    try {
+      const payload = authService.parseStaffPhoneVerify(req.body);
+      const session = await authService.verifyStaffPhoneAuth(payload, { fetchImpl });
+      return res.status(200).json({
+        ...session,
+        requestId: req.requestId,
+      });
+    } catch (error) {
+      return next(error);
+    }
+  });
+
   router.get('/session', requireAuth, async (req, res, next) => {
     try {
       const session = await authService.getSessionForActor(req.actor);