OTP test infrastructure for Maestro flows

Dev-only /internal/_test/peek-otp + /internal/_test/reset-phone endpoints
gated by NODE_ENV !== 'production'. peek-otp reads the latest stub OTP
out of an in-memory map populated by otp.service.js fazpassSendStub;
reset-phone wipes otp_requests rows (and optionally the customers row)
so flows can re-run without tripping cooldowns.

JS + shell helpers under .maestro/scripts/ wrap the endpoints for use
inside Maestro runScript steps. 01_smoke.yaml expanded from a launch-only
sanity check to a full cold-start onboarding -> force-register -> OTP ->
home walk.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/services/otp.service.js

@@ -26,9 +26,17 @@ const generate6DigitCode = () => {
   return String(crypto.randomInt(0, 1_000_000)).padStart(6, '0')
 }
 
+// Dev-only in-memory cache of latest stub OTP per phone, read by the
+// /internal/_test/peek-otp endpoint to make Maestro flows deterministic
+// without baking test phone numbers into production code paths.
+const stubOtpByPhone = new Map()
+
+export const peekStubOtp = (phone) => stubOtpByPhone.get(phone) ?? null
+
 const fazpassSendStub = async ({ phone, channel }) => {
   const reference = `stub_${crypto.randomUUID()}`
   const code = generate6DigitCode()
+  stubOtpByPhone.set(phone, { code, reference, channel, generated_at: new Date().toISOString() })
   // Log the code so developers can read it during dev testing.
   // eslint-disable-next-line no-console
   console.log(`[OTP STUB] phone=${phone} channel=${channel} code=${code} ref=${reference}`)