feat(backoffice): add an Account tab with the customer's portal logins

The detail page showed the company's business contact details but not the
credentials anyone actually signs in with, and the two drift apart
routinely — so "the customer says they can't log in" was unanswerable
from this screen.

Adds `GET /backoffice/customers/:companyId/accounts`, joining each
external profile to its IAM account, primary contact first. Deliberately
not filtered to active accounts: a suspended or never-activated login is
exactly the case being looked into. The user query selects columns
explicitly — the entity's relations include credentials and sessions, and
this response reaches a browser.

Rendered as cards rather than a table: it is a handful of rows of
mostly-optional fields, which a table renders as a field of dashes.
"Password never set" is called out on its own, being the usual answer to
"they never got in", and a profile whose IAM user is gone reads as a red
fault rather than an inactive status.

apps/edr-freight-web/backoffice/src/services/api.ts

@@ -13,6 +13,7 @@ import type {
   CustomerBooking,
   CustomerDocument,
   CustomerPayment,
+  CustomerAccount,
   CustomerResetTarget,
   PaginatedCompanies,
   ProfileStatus,
@@ -3222,6 +3223,13 @@ export const api = {
       ({ id }) => QUERY_KEYS.CUSTOMERS.payments(id),
     ),
 
+    accounts: endpoint<{ companyId: string }, CustomerAccount[]>(
+      "customers",
+      "accounts",
+      ({ companyId }) => customersService.accounts(companyId),
+      ({ companyId }) => QUERY_KEYS.CUSTOMERS.accounts(companyId),
+    ),
+
     resetTarget: endpoint<{ companyId: string }, CustomerResetTarget>(
       "customers",
       "resetTarget",

apps/edr-freight-web/backoffice/src/services/customers.service.ts

@@ -10,6 +10,7 @@ import type {
   CustomerBooking,
   CustomerDocument,
   CustomerPayment,
+  CustomerAccount,
   CustomerResetTarget,
   PaginatedCompanies,
   ProfileStatus,
@@ -90,6 +91,18 @@ export const customersService = {
       .then((r) => r.data);
   },
 
+  /**
+   * Every portal login belonging to this customer, primary contact first.
+   *
+   * Not filtered to active accounts — a suspended or never-activated login is
+   * exactly what staff are checking when a customer says they cannot sign in.
+   */
+  accounts(companyId: string): Promise<CustomerAccount[]> {
+    return apiClient
+      .get<CustomerAccount[]>(URL_CONSTANTS.COMPANIES.ACCOUNTS(companyId))
+      .then((r) => r.data);
+  },
+
   /**
    * The IAM account a reset link would go to. Read before offering the action
    * so staff see the credentials the link actually reaches, not the company's