OTP test infrastructure for Maestro flows

Dev-only /internal/_test/peek-otp + /internal/_test/reset-phone endpoints
gated by NODE_ENV !== 'production'. peek-otp reads the latest stub OTP
out of an in-memory map populated by otp.service.js fazpassSendStub;
reset-phone wipes otp_requests rows (and optionally the customers row)
so flows can re-run without tripping cooldowns.

JS + shell helpers under .maestro/scripts/ wrap the endpoints for use
inside Maestro runScript steps. 01_smoke.yaml expanded from a launch-only
sanity check to a full cold-start onboarding -> force-register -> OTP ->
home walk.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/.maestro/scripts/peek_otp.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Read the latest stub-generated OTP code for ${TEST_PHONE} from the
+# backend's dev-only /internal/_test/peek-otp endpoint.
+#
+# Echoes the 6-digit code to stdout. Maestro captures the last line of
+# stdout into the variable named by the calling runScript step.
+set -euo pipefail
+
+phone="${TEST_PHONE:-}"
+url="${BACKEND_INTERNAL_URL:-http://localhost:3001}"
+
+if [[ -z "$phone" ]]; then
+  echo "TEST_PHONE env var required" >&2
+  exit 1
+fi
+
+# url-encode the leading +
+encoded_phone="$(printf %s "$phone" | sed 's/+/%2B/')"
+resp="$(curl -fsS "${url}/internal/_test/peek-otp?phone=${encoded_phone}")"
+echo "$resp" | jq -r .code