feat: ( payment ) wire CAC Bank OTP flow through passenger-api, portal, and backoffice

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -34,6 +34,7 @@ import {
   PaymentPlatformDto,
   BookingAmountResponseDto,
   ForceConfirmDto,
+  ConfirmOtpDto,
 } from "./payments.dto";
 import { PassengerStaff } from "../../common/passenger-guards";
 import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";
@@ -94,6 +95,21 @@ export class PaymentsController {
     return this.service.getIntentByBookingId(bookingId);
   }
 
+  @Post(":bookingId/confirm")
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
+    summary: "Confirm an OTP-debit payment (CAC Bank)",
+    description:
+      "Submits the OTP the payer received by SMS. Returns the updated intent status. " +
+      "A wrong or expired OTP returns 400 and the payment stays open for retry.",
+  })
+  confirmOtp(
+    @Param("bookingId") bookingId: string,
+    @Body() dto: ConfirmOtpDto,
+  ) {
+    return this.service.confirmOtpPayment(bookingId, dto.otp);
+  }
+
   @Get("waafi/return")
   @SetMetadata('isPublic', true)
   @ApiOperation({