Phase 3.3: topic sensitivity + Phase 3.4: auth foundation

Phase 3.3 — Session Topic Sensitivity (complete):
- Backend: topic_sensitivity column + session_sensitivity_log, sensitivity service
  (flip with one-way-latch + audit), PATCH /api/shared/chat/sessions/:id/topic,
  topic carried in pairing + extension WS payloads, CC filter + sensitive stats
  + per-mitra sensitive columns on activity page
- client_app: TopicSelectionBottomSheet before pricing, topic flows through
  pairing request, silent WS handler for session_topic_updated
- mitra_app: SensitivityBadge + SensitivityTheme + sensitivityConfigProvider,
  overlay badge + yellow accent, chat screen app-bar toggle with configurable
  confirmation + latch, extension card shows current flag, history + transcript
  yellow theme
- control_center: Sensitivitas Topik settings section, topic filter + column
  with inline audit log, sensitive stats dashboard card, mitra activity
  sensitive columns with QC flag

Phase 3.4 — Self-Managed Auth (foundation only):
- Migration: auth_sessions + otp_requests tables, social identity columns on
  customers, password_hash + lockout on control_center_users, OTP + CC lockout
  app_config keys
- New services: password (bcrypt + complexity), token (JWT HS256 + refresh
  rotation, session_id claim pre-wires future Valkey revocation),
  social-identity (Google + Apple JWKS), OTP (Fazpass stub — real API TBD)
- Constants: AuthProvider + OtpChannel
- Middleware, auth route rewrites, WS auth update, Firebase → FCM isolation
  still pending (next chunk); Fazpass docs + Apple Developer setup still
  required before E2E testing

Docs:
- requirement/phase3.3.md, phase3.3-plan.md, phase3.3-testing.md
- requirement/phase3.4.md, phase3.4-plan.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/services/extension.service.js

@@ -17,7 +17,7 @@ const getExtensionTimeout = async () => {
 export const requestExtension = async (sessionId, customerId, { duration_minutes, price }) => {
   // Verify session belongs to customer and is in an extendable state
   const [session] = await sql`
-    SELECT id, customer_id, mitra_id, status FROM chat_sessions
+    SELECT id, customer_id, mitra_id, status, topic_sensitivity FROM chat_sessions
     WHERE id = ${sessionId} AND customer_id = ${customerId}
       AND status IN (${SessionStatus.ACTIVE}, ${SessionStatus.CLOSING})
   `
@@ -35,13 +35,14 @@ export const requestExtension = async (sessionId, customerId, { duration_minutes
   // Pause the session
   await sql`UPDATE chat_sessions SET status = ${SessionStatus.EXTENDING} WHERE id = ${sessionId}`
 
-  // Notify mitra
+  // Notify mitra — include current topic sensitivity so UI can highlight
   sendToSessionParticipant(sessionId, UserType.MITRA, {
     type: WsMessage.EXTENSION_REQUEST,
     extension_id: extension.id,
     session_id: sessionId,
     duration_minutes,
     price,
+    topic_sensitivity: session.topic_sensitivity,
   })
 
   // Notify customer that chat is paused