OTP overhaul: test-user bypass + hash-at-rest + Fazpass integration

- Test-OTP bypass allowlist for Apple reviewers / QA: phone-scoped static OTPs
  managed in CC (Settings → Test OTP Bypass), bcrypt-hashed on save, kill-switch
  toggle, per-entry expires_at. New `otp_requests` columns (is_bypass, code_hash)
  + DB CHECK enforcing bypass-row shape.
- Hash-at-rest for stub OTPs: replaced plaintext `<ref>:<code>` storage with
  bcrypt(code_hash); reference goes to fazpass_reference alone. Verify routes on
  sovereign is_bypass flag, defers code_hash-NULL rows to Fazpass.
- Fazpass integration (gated by FAZPASS_ENABLED env, default off): new
  fazpass.service.js calling /v1/otp/{request,verify}; distinct errors for wrong
  OTP (CODE_MISMATCH 401) vs provider outage (OTP_PROVIDER_FAILED 502).
- Removed redundant Free Trial CC section (was a back-compat shim for the same
  pricing_promotions row as "Diskon Sesi Pertama") + unused alias in
  pricing.service.js.

208 tests green (34 new for OTP + Fazpass). Fazpass API + dashboard PDFs added
at project root for reference (docs are auth-gated).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/routes/public/mitra.auth.routes.js

@@ -30,6 +30,7 @@ export const mitraAuthRoutes = async (app) => {
         userType: UserType.MITRA,
         ipAddress: request.ip,
         channel,
+        logger: request.log,
       })
       return reply.send({ success: true, data: result })
     } catch (err) {
@@ -40,7 +41,7 @@ export const mitraAuthRoutes = async (app) => {
   app.post('/otp/verify', async (request, reply) => {
     const { otp_request_id, code } = request.body || {}
     try {
-      const { phone, user_type } = await verifyOtp({ otpRequestId: otp_request_id, code })
+      const { phone, user_type } = await verifyOtp({ otpRequestId: otp_request_id, code, logger: request.log })
       if (user_type !== UserType.MITRA) {
         return reply.code(400).send({
           success: false,