OTP overhaul: test-user bypass + hash-at-rest + Fazpass integration

- Test-OTP bypass allowlist for Apple reviewers / QA: phone-scoped static OTPs
  managed in CC (Settings → Test OTP Bypass), bcrypt-hashed on save, kill-switch
  toggle, per-entry expires_at. New `otp_requests` columns (is_bypass, code_hash)
  + DB CHECK enforcing bypass-row shape.
- Hash-at-rest for stub OTPs: replaced plaintext `<ref>:<code>` storage with
  bcrypt(code_hash); reference goes to fazpass_reference alone. Verify routes on
  sovereign is_bypass flag, defers code_hash-NULL rows to Fazpass.
- Fazpass integration (gated by FAZPASS_ENABLED env, default off): new
  fazpass.service.js calling /v1/otp/{request,verify}; distinct errors for wrong
  OTP (CODE_MISMATCH 401) vs provider outage (OTP_PROVIDER_FAILED 502).
- Removed redundant Free Trial CC section (was a back-compat shim for the same
  pricing_promotions row as "Diskon Sesi Pertama") + unused alias in
  pricing.service.js.

208 tests green (34 new for OTP + Fazpass). Fazpass API + dashboard PDFs added
at project root for reference (docs are auth-gated).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/services/pricing.service.js

@@ -203,12 +203,6 @@ export const getExtensionPriceTiers = async (customerId) => {
 
 // ---- Back-compat aliases (will be removed after Phase 4 frontend cutover) ----
 
-/**
- * @deprecated Use isCustomerEligibleForFirstSessionDiscount.
- * Kept so route handlers and migrated services still resolve while we cut over.
- */
-export const isCustomerEligibleForFreeTrial = isCustomerEligibleForFirstSessionDiscount
-
 /**
  * @deprecated Tiers now live in `chat`/`call` groups; callers should pick one.
  * Returns chat tiers in the legacy shape (single array, no group wrapper).