Phase 4 Stage 2: onboarding redesign (client_app + mitra_app)

Verif Choice Sheet on display_name_screen drives the user into either
the verified or anonymous onboarding sub-flow. ESP screen (12 chips,
multi-select, info-only) + USP screen are shared between both branches;
selections persist through to chat_sessions.topics on session start.

OTP-blocked popup (HaloPopup) listens for the four real OTP-rate-limit
error codes (OTP_RATE_LIMIT_PHONE, OTP_RATE_LIMIT_IP, OTP_COOLDOWN,
OTP_ATTEMPTS_EXCEEDED) and drops the user onto the anonymous path with
ESP/USP state preserved.

Auth-providers gating replaces the --dart-define=ENABLE_SOCIAL_AUTH
build flag with server-driven discovery. authProvidersProvider preloads
GET /api/shared/auth-providers at cold start; welcome/register/
force-register screens render Google/Apple buttons only when the
backend reports enabled:true. Falls back to phone-OTP-only when both
providers are off. social_auth_enabled.dart deleted; client_app/CLAUDE.md
updated to reflect the new gating contract.

Mitra app: chat screen renders an ESP chip strip above the first message
bubble when chat_sessions.topics is non-empty.

Backend session.service.js getSessionById SELECTs cs.topics so the mitra
side can read the customer's selected topics.

Maestro flows 02_onboarding_verified.yaml + 03_onboarding_anon.yaml.

Deviation from plan: plan referenced OTP error code 'otp_retry_exhausted';
real codes are OTP_RATE_LIMIT_*/OTP_COOLDOWN/OTP_ATTEMPTS_EXCEEDED -
popup listens for all four. Plan said 'has_paid_first_session'; live
endpoint returns 'has_consulted_before' - used the live field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/.maestro/flows/02_onboarding_verified.yaml

@@ -0,0 +1,115 @@
+# Phase 4 Stage 2 — verified onboarding path:
+#   Splash → onboarding carousel → Welcome → Display Name → Verif Choice Sheet
+#   (verifikasi nomor HP) → ESP (pick a chip) → USP → Register → OTP (6-digit)
+#   → S6 paywall (when first-session-discount eligible) or duration picker.
+#
+# Run:
+#   maestro test client_app/.maestro/flows/02_onboarding_verified.yaml
+#
+# Pre-reqs: client_app debug APK installed, backend reachable at
+# BACKEND_URL/BACKEND_INTERNAL_URL, NODE_ENV != 'production' (so the
+# /internal/_test/peek-otp + /reset-phone routes register), and
+# `anonymity_enabled = true` in the dev DB so the verif choice sheet shows.
+#
+# NOTE: numeric prefix conflicts with the existing
+# 02_cta_disabled_when_no_mitra.yaml — Stage 9 will reorganize the flow
+# directory once the full Phase 4 suite lands.
+appId: com.halobestie.client.client_app
+env:
+  TEST_PHONE: "+628155557701"
+  BACKEND_INTERNAL_URL: http://localhost:3001
+---
+- runScript:
+    file: ../scripts/reset_phone.js
+    env:
+      TEST_PHONE: ${TEST_PHONE}
+      BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL}
+- launchApp:
+    clearState: true
+- extendedWaitUntil:
+    visible:
+      text: "Mulai"
+    timeout: 15000
+- tapOn:
+    text: "Mulai"
+    retryTapIfNoChange: true
+- extendedWaitUntil:
+    visible:
+      text: "Lanjut sebagai Tamu"
+    timeout: 10000
+- tapOn:
+    text: "Lanjut sebagai Tamu"
+    retryTapIfNoChange: true
+- extendedWaitUntil:
+    visible:
+      text: "Nama panggilan"
+    timeout: 10000
+- tapOn:
+    text: "Nama panggilan"
+- inputText: "Maestro"
+- hideKeyboard
+- tapOn:
+    text: "lanjut"
+    retryTapIfNoChange: true
+# Verif Choice Sheet
+- extendedWaitUntil:
+    visible:
+      text: "verifikasi nomor HP"
+    timeout: 10000
+- tapOn:
+    text: "verifikasi nomor HP"
+    retryTapIfNoChange: true
+# ESP screen — pick at least one chip then tap "lanjut"
+- extendedWaitUntil:
+    visible:
+      text: "Lagi mikirin apa?"
+    timeout: 10000
+- tapOn:
+    text: "Hubungan"
+- tapOn:
+    text: "lanjut"
+    retryTapIfNoChange: true
+# USP screen
+- extendedWaitUntil:
+    visible:
+      text: "Sebelum mulai"
+    timeout: 10000
+- tapOn:
+    text: "aku ngerti, lanjut"
+    retryTapIfNoChange: true
+# Register (S3a) — phone entry
+- extendedWaitUntil:
+    visible:
+      text: "Nomor HP"
+    timeout: 10000
+- tapOn:
+    text: "Nomor HP"
+- inputText: ${TEST_PHONE}
+- hideKeyboard
+- tapOn:
+    text: "kirim OTP"
+    retryTapIfNoChange: true
+# OTP screen (S3b)
+- extendedWaitUntil:
+    visible:
+      text: "Masukkan OTP"
+    timeout: 15000
+- runScript:
+    file: ../scripts/peek_otp.js
+    env:
+      TEST_PHONE: ${TEST_PHONE}
+      BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL}
+- inputText: ${output.OTP}
+# Verified path: first-session-discount eligible customers land on the S6
+# paywall; non-eligibles land on the duration picker. Either is acceptable
+# arrival for this flow.
+- extendedWaitUntil:
+    visible:
+      text: "Masukkan OTP"
+    timeout: 15000
+    notVisible: true
+- extendedWaitUntil:
+    visible:
+      text: "harga sesi pertama"
+    timeout: 15000
+    optional: true