fix(customer-auth): register customers into the app's organization

Registration put every new customer into a hardcoded organization id,
which does not exist in staging, so set-password failed on the
fk_customers_organization foreign key with a 500.

POST /customer-auth/register/start now takes organization_id, the
organization the app is built for. It must be a UUID of an existing
organization, checked before the OTP is sent; it is kept in the OTP
session and set-password creates the customer there. A registration
started before this change has no organization in its session and is asked
to start again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validator/customer_auth_validator.go

@@ -5,6 +5,8 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/google/uuid"
+
 	"apskel-pos-be/internal/constants"
 	"apskel-pos-be/internal/contract"
 )
@@ -68,6 +70,11 @@ func (v *CustomerAuthValidatorImpl) ValidateRegisterStartRequest(req *contract.R
 		return errors.New("name cannot exceed 100 characters"), constants.ValidationErrorCode
 	}
 
+	// Validate organization
+	if _, err := uuid.Parse(strings.TrimSpace(req.OrganizationID)); err != nil {
+		return errors.New("organization_id must be a valid UUID"), constants.ValidationErrorCode
+	}
+
 	// Validate birth date
 	if strings.TrimSpace(req.BirthDate) == "" {
 		return errors.New("birth date is required"), constants.ValidationErrorCode