fix(auth): resolve tenant slug to UUID before user queries

backend/src/modules/auth/auth.service.ts

@@ -3,6 +3,7 @@ import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import { UsersService } from '../users/users.service';
 import { User } from '../users/entities/user.entity';
+import { TenantsService } from '../tenants/tenants.service';
 
 @Injectable()
 export class AuthService {
@@ -12,8 +13,16 @@ export class AuthService {
     private usersService: UsersService,
     private jwtService: JwtService,
     private config: ConfigService,
+    private tenantsService: TenantsService,
   ) {}
 
+  /** يحوّل الـ slug القادم من الهيدر إلى UUID المستأجر (tenant_id). */
+  private async resolveTenantId(tenantSlugOrId: string): Promise<string> {
+    const tenant = await this.tenantsService.resolve(tenantSlugOrId);
+    if (!tenant) throw new UnauthorizedException('Unknown tenant');
+    return tenant.id;
+  }
+
   private get devCode(): string {
     // رمز التطوير الثابت — يُستبدل بمحوّل SMS في P2 (راجع docs/07).
     return '1234';
@@ -29,11 +38,14 @@ export class AuthService {
     };
   }
 
-  async verifyOtp(tenantId: string, phone: string, code: string) {
+  async verifyOtp(tenantSlug: string, phone: string, code: string) {
     if (code !== this.devCode) {
       throw new UnauthorizedException('Invalid OTP code');
     }
 
+    // الهيدر يحمل slug — نحوّله لـ UUID قبل أي استعلام على tenant_id.
+    const tenantId = await this.resolveTenantId(tenantSlug);
+
     let user = await this.usersService.findByPhone(tenantId, phone);
     if (!user) {
       user = await this.usersService.create(tenantId, phone);