feat(auth): implement staff-triggered password-reset links

apps/edr-freight-web/backoffice/src/services/api.ts

@@ -10,6 +10,7 @@ import type {
   CustomerBooking,
   CustomerDocument,
   CustomerPayment,
+  CustomerResetTarget,
   PaginatedCompanies,
   ProfileStatus,
   ResetChannel,
@@ -2581,6 +2582,13 @@ export const api = {
       ({ id }) => QUERY_KEYS.CUSTOMERS.payments(id),
     ),
 
+    resetTarget: endpoint<{ companyId: string }, CustomerResetTarget>(
+      "customers",
+      "resetTarget",
+      ({ companyId }) => customersService.resetTarget(companyId),
+      ({ companyId }) => QUERY_KEYS.CUSTOMERS.resetTarget(companyId),
+    ),
+
     resetPassword: endpoint<
       { companyId: string; channel: ResetChannel },
       ResetPasswordResult

apps/edr-freight-web/backoffice/src/services/customers.service.ts

@@ -9,6 +9,7 @@ import type {
   CustomerBooking,
   CustomerDocument,
   CustomerPayment,
+  CustomerResetTarget,
   PaginatedCompanies,
   ProfileStatus,
   ResetChannel,
@@ -89,8 +90,20 @@ export const customersService = {
   },
 
   /**
-   * Send a password-reset code to the company's primary contact. Staff never
-   * receive a credential — the customer sets their own password from the code.
+   * The IAM account a reset link would go to. Read before offering the action
+   * so staff see the credentials the link actually reaches, not the company's
+   * business contact details.
+   */
+  resetTarget(companyId: string): Promise<CustomerResetTarget> {
+    return apiClient
+      .get<CustomerResetTarget>(URL_CONSTANTS.COMPANIES.RESET_TARGET(companyId))
+      .then((r) => r.data);
+  },
+
+  /**
+   * Send a password-reset link to the company's primary contact. Staff never
+   * receive a credential — the customer opens the link and sets their own
+   * password.
    */
   resetPassword(
     companyId: string,