Phase 4 §4: payment-before-pair for returning users + Maestro suite

Stages 5.1, 5.3, 5.4 of the returning-user flow rework. All three §4
entry paths now require payment BEFORE pairing, matching the updated
mermaid spec.

* Spec (requirement/flow_customer.mermaid.md §4): payment block converges
  three call-sites (bestie-yang-udah-kenal-online, bestie-baru,
  offline-popup → cari bestie lain). PairRoute dispatches lama → targeted
  pair, baru/cari-lain → §3 blast. §3 retains its post-payment-shared
  contract.

* Stage 5.1 (client_app): PaymentDraft carries targetedMitraId +
  topicSensitivity. bestie_history_list seeds the draft + pushes
  /payment/entry (was legacy /payment). searching_screen branches on
  draft.targetedMitraId for blast-vs-targeted dispatch.
  payment_entry uses resetExceptTarget(); bestie_choice_sheet + home
  _onCurhatBestieBaruPressed call explicit reset() before push so
  the keepAlive draft can't leak stale targeting into a blast.

* Stage 5.3 (client_app): new BestieOfflineVariant.prePayReturning.
  Bestie-history-list _BestieRow splits tappable from dim so offline
  rows render dimmed but route taps into the popup. CTA "cari bestie
  lain" resets the draft + pushes /payment/entry.

* Stage 5.4 (client_app): deleted legacy /payment route,
  payment_screen.dart, payment_notifier.dart(+.g.dart). router cleaned.

* Tests (requirement/phase4-customer-flow.md + client_app/.maestro/):
  six Maestro flows TS-01..TS-06 covering every §4 branching point,
  all passing end-to-end. Shared onboarding prelude under
  .maestro/subflows/. New helper scripts: accept_latest_pending,
  force_mitra_offline, force_other_mitra_online,
  reset_all_mitras_online, mitra_accept_latest_internal. New backend
  _test endpoints to match. /reset-phone now cascade-deletes
  customer_transactions (FK was blocking). /force-pairing-timeout
  branches targeted (RETURNING_CHAT_TIMEOUT via
  expireTargetedPairingRequest, now exported) vs blast (PAIRING_FAILED).
  seed_history_session also outputs MITRA_NAME_RE (regex-escaped) for
  reliable selectors against display names containing regex specials.

* mitra_app: dispose-during-deactivate guardrail for back-press on the
  mitra chat screen after the customer's goodbye message. Pending real
  emulator repro verification (carried over from 2026-05-15).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/.maestro/subflows/onboarding_returning_user.yaml

@@ -0,0 +1,100 @@
+# Shared onboarding prelude for Phase 4 §4 "returning user" Maestro flows
+# (TS-01 through TS-06 — see requirement/phase4-customer-flow.md).
+#
+# This subflow drives a clean-slate emulator from cold start to /home as a
+# verified customer. The verified+display-name'd state is the precondition
+# for every TS scenario in §4, so we extract it here to avoid ~80 lines of
+# duplication across the six flows.
+#
+# Pre-reqs (parent flow's responsibility):
+#   - Parent flow has `env:` block defining TEST_PHONE and
+#     BACKEND_INTERNAL_URL (Maestro subflows inherit env from caller).
+#   - Parent flow runs `reset_phone.js` + `launchApp clearState: true`
+#     BEFORE invoking this subflow.
+#   - NODE_ENV != 'production' on backend (so /internal/_test routes exist).
+#
+# Path taken:
+#   Welcome carousel ("Mulai") → Home with anon banner →
+#   tap "masuk →" → /auth/register → enter +62 subscriber digits →
+#   "kirim kode" → OTP screen → peek OTP from stub → auto-submit →
+#   /auth/set-name (because AuthNeedsDisplayNameData) → enter "Maestro" →
+#   "Lanjut" → /home (returning view: "curhatan sebelumnya" header).
+#
+# Selector style: Flutter merges sibling Text widgets inside a single
+# tappable parent into ONE accessibility blob. Maestro's `text:` selector
+# does a FULL-string regex match, so we wrap selectors in `(?s).*…*` for
+# anything that lives inside an InkWell with multiple Texts. Empty
+# TextFields don't expose their hint to Maestro a11y, so we tap by point
+# inside the field's pill before typing.
+appId: ${APP_ID_ANDROID}
+---
+# Welcome carousel — the "Mulai" button is the only Text inside its
+# tappable region, so a plain selector works.
+- extendedWaitUntil:
+    visible:
+      text: "Mulai"
+    timeout: 15000
+- tapOn:
+    text: "Mulai"
+    retryTapIfNoChange: true
+
+# Home — login-recover banner ("udah pernah pakai HaloBestie? … masuk →")
+# is one InkWell, so any token within its merged blob reaches the
+# /auth/register handler.
+- extendedWaitUntil:
+    visible:
+      text: "(?s).*udah pernah pakai HaloBestie.*"
+    timeout: 30000
+- tapOn:
+    text: "(?s).*masuk →.*"
+
+# Register screen — personalised title "nomor wa-mu, {name}?" is in a
+# merged blob with the subtitle copy.
+- extendedWaitUntil:
+    visible:
+      text: "(?s).*nomor wa-mu.*"
+    timeout: 10000
+
+# Phone input — +62 is a static prefix chip; type only subscriber digits
+# (no leading 0). +6281234567890 → 81234567890. Tap by point inside the
+# pill (well right of the +62 chip, well above the kirim-kode button).
+- tapOn:
+    point: "60%, 47%"
+- inputText: "81234567890"
+- hideKeyboard
+- tapOn:
+    text: "(?s).*kirim kode.*"
+
+# OTP screen — peek the code from the stub endpoint.
+- extendedWaitUntil:
+    visible:
+      text: "Masukkan OTP"
+    timeout: 15000
+- runScript:
+    file: ../scripts/peek_otp.js
+    env:
+      TEST_PHONE: ${TEST_PHONE}
+      BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL}
+- inputText: ${output.OTP}
+
+# After 6th digit OTP auto-submits. The anon customer's phone is attached
+# but display_name is still empty → AuthNeedsDisplayNameData → router
+# pushes /auth/set-name ("Siapa namamu?").
+- extendedWaitUntil:
+    visible:
+      text: "(?s).*Siapa namamu.*"
+    timeout: 20000
+# Same TextField-hint-invisible-to-Maestro issue as the phone field — tap
+# by point inside the "Nama panggilan" pill, then type a display name.
+- tapOn:
+    point: "50%, 30%"
+- inputText: "Maestro"
+- hideKeyboard
+- tapOn: "Lanjut"
+
+# Now home renders the returning view ("curhatan sebelumnya" section
+# header is the deterministic landmark — appears regardless of history).
+- extendedWaitUntil:
+    visible:
+      text: "(?s).*curhatan sebelumnya.*"
+    timeout: 30000