fix(otp): fall back to email for foreign phone numbers

The SMS gateway is domestic-only, but OTP sends fanned out to any phone
on the account - a foreign number meant a code queued into the void
while the response claimed success. isDomesticPhone (+2519/+2517 E.164)
now gates SMS: dual-channel sends with a foreign phone go email-only
(the phone stays on the row so verify still matches it), and a
phone-only foreign target still tries SMS as the only route. The
staff-triggered reset exposes phoneIsDomestic so the backoffice disables
the SMS channel with an explanation, and the API refuses the channel
directly for foreign numbers.

EDRFREIGHT-186

apps/edr-freight-api/src/modules/auth/customer-reset.service.ts

@@ -12,6 +12,7 @@ import {
   RESET_LINK_TTL_MS,
 } from "./forgot-password.service";
 import { maskOtpTarget } from "./mask-target.util";
+import { isDomesticPhone } from "../otp/otp.service";
 
 /** The account a staff-triggered reset would land on. */
 export interface CustomerResetTarget {
@@ -19,6 +20,12 @@ export interface CustomerResetTarget {
   name: string;
   email: string | null;
   phone: string | null;
+  /**
+   * Whether the SMS gateway (domestic-only) can reach `phone`. `null` when
+   * there is no phone. The backoffice uses this to disable the SMS channel for
+   * foreign numbers instead of sending a link that will never arrive.
+   */
+  phoneIsDomestic: boolean | null;
 }
 
 export interface SentResetLink {
@@ -58,6 +65,9 @@ export class CustomerResetService {
       name: `${profile.firstName} ${profile.lastName}`.trim(),
       email: user.email ?? null,
       phone: user.phoneNumber ?? null,
+      phoneIsDomestic: user.phoneNumber
+        ? isDomesticPhone(user.phoneNumber)
+        : null,
     };
   }
 
@@ -80,6 +90,17 @@ export class CustomerResetService {
     const target = this.forgotPasswordService.targetFor(user, channel);
     if (!target) return null;
 
+    // A foreign number is unreachable by the domestic-only SMS gateway — treat
+    // it like a missing phone rather than reporting "link sent" for a message
+    // that will never arrive. The backoffice disables the channel up front via
+    // `phoneIsDomestic`; this guards direct API calls.
+    if (channel === "phone" && target.phone && !isDomesticPhone(target.phone)) {
+      this.logger.warn(
+        `Staff reset via SMS refused for user ${userId} — non-domestic phone`,
+      );
+      return null;
+    }
+
     // Mint first, send second: a failed send leaves an unused ticket that simply
     // expires, whereas sending a link before the ticket exists would hand the
     // customer a URL that is dead on arrival.