feat(customers): store customer phone numbers as 62…

A customer's phone number (customers.phone_number, the one they log in with) has
one stored form, 62 followed by the number without its 0: 6281234561234.
util.NormalizePhoneNumber rewrites 0812…, +62 812…, 62812…, 812… and +62 0812…,
with spaces, dashes, dots or parentheses, to it, and refuses anything that is not
an Indonesian mobile number (628 and 7 to 11 more digits).

It is applied wherever a customer types their number: check-phone, register,
login and resend-OTP (the validator rewrites the request), and the transfer
recipient. Before, the number was matched as typed and a leading 0 was refused,
so the same customer written another way was not found. The masked recipient
stays 08**-****-1234 as customers write numbers.

Migration 000116 rewrites the numbers already stored in customers and
otp_sessions. When several become the same number, the customer that already has
it keeps it, else a registered one, else the oldest; the others, and numbers that
are not Indonesian mobile numbers, are left as they are and cannot log in until
fixed by hand (the query to find them is in the migration). Down does nothing.

The migration was run, twice, against Postgres with a reduced customers and
otp_sessions schema and sample numbers; not against the real schema. The
Postgres tests were not run. customers.phone (the POS contact number) is not
touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validator/customer_auth_validator.go

@@ -9,6 +9,7 @@ import (
 
 	"apskel-pos-be/internal/constants"
 	"apskel-pos-be/internal/contract"
+	"apskel-pos-be/internal/util"
 )
 
 type CustomerAuthValidator interface {
@@ -36,7 +37,7 @@ func (v *CustomerAuthValidatorImpl) ValidateCheckPhoneRequest(req *contract.Chec
 		return errors.New("phone number is required"), constants.ValidationErrorCode
 	}
 
-	if !v.isValidPhoneNumber(req.PhoneNumber) {
+	if !v.normalizePhoneNumber(&req.PhoneNumber) {
 		return errors.New("invalid phone number format"), constants.ValidationErrorCode
 	}
 
@@ -53,7 +54,7 @@ func (v *CustomerAuthValidatorImpl) ValidateRegisterStartRequest(req *contract.R
 		return errors.New("phone number is required"), constants.ValidationErrorCode
 	}
 
-	if !v.isValidPhoneNumber(req.PhoneNumber) {
+	if !v.normalizePhoneNumber(&req.PhoneNumber) {
 		return errors.New("invalid phone number format"), constants.ValidationErrorCode
 	}
 
@@ -161,7 +162,7 @@ func (v *CustomerAuthValidatorImpl) ValidateCustomerLoginRequest(req *contract.C
 		return errors.New("phone number is required"), constants.ValidationErrorCode
 	}
 
-	if !v.isValidPhoneNumber(req.PhoneNumber) {
+	if !v.normalizePhoneNumber(&req.PhoneNumber) {
 		return errors.New("invalid phone number format"), constants.ValidationErrorCode
 	}
 
@@ -174,10 +175,15 @@ func (v *CustomerAuthValidatorImpl) ValidateCustomerLoginRequest(req *contract.C
 }
 
 // Helper validation functions
-func (v *CustomerAuthValidatorImpl) isValidPhoneNumber(phoneNumber string) bool {
-	// Basic phone number validation - adjust regex based on your requirements
-	phoneRegex := regexp.MustCompile(`^\+?[1-9]\d{1,14}$`)
-	return phoneRegex.MatchString(phoneNumber)
+// normalizePhoneNumber rewrites the phone number in the form it is stored in, 62…
+// (util.NormalizePhoneNumber), and reports false when it is not a valid one.
+func (v *CustomerAuthValidatorImpl) normalizePhoneNumber(phoneNumber *string) bool {
+	normalized, err := util.NormalizePhoneNumber(*phoneNumber)
+	if err != nil {
+		return false
+	}
+	*phoneNumber = normalized
+	return true
 }
 
 func (v *CustomerAuthValidatorImpl) isValidDateFormat(date string) bool {
@@ -208,7 +214,7 @@ func (v *CustomerAuthValidatorImpl) ValidateResendOtpRequest(req *contract.Resen
 	}
 
 	// Validate phone number format
-	if !v.isValidPhoneNumber(req.PhoneNumber) {
+	if !v.normalizePhoneNumber(&req.PhoneNumber) {
 		return errors.New("invalid phone number format"), constants.CustomerEntity
 	}