Remove platform tenancy from SXCHNGE customer BFF (#34)

docs/implementation.md

@@ -363,44 +363,56 @@ Delivery: [PR #33](https://git.sendico.io/tech/sxchnge/pulls/33) targets `main`;
 committed and pushed, unmerged. Issue #32 and PR #33 metadata verified: frontend
 label, tech owner and SXCHNGE project. No stacked dependencies.
 
-## Copied BFF foundation and public Sendico contracts — task #34
+## Minimal customer BFF and public Sendico contracts — task #34
 
-Bootstrapped SXCHNGE from Sendico revision
-`8bb20dcd622dd8eb92d289b6b34411e7eccab083`: shared HTTP runtime, authentication
-and session stack, verification and refresh storage, account service, Mongo
-repositories, authorization, canonical models/errors and structured logging.
-The original handwritten shell and replacement helpers were removed. File-level
-[provenance](../backend/PROVENANCE.json) records 416 copied Go files and 112 public
-OpenAPI files. The source checkout and its unrelated dependency edits were untouched.
+[Task #34](https://git.sendico.io/tech/sxchnge/issues/34), branch `bff-34`,
+[PR #35](https://git.sendico.io/tech/sxchnge/pulls/35) into `main`.
 
-The corrected [architecture](architecture/bff.md) reflects the product boundary:
-SXCHNGE owns customers/authentication; SXCHNGE itself is one Sendico organization;
-all Sendico access uses the public HTTP API. Internal gRPC, discovery, messaging,
-platform service factories and organization provisioning were excluded. Public
-OpenAPI is isolated from local models and tested for self-contained references.
-No live provider call, organization, customer or payment was created.
+The initial copy at `7062672` incorrectly retained Sendico's local tenancy model.
+The correction removes organization membership, roles, Casbin, policy storage and
+seeding, invitations and their models/repositories/tests. It also removes unused
+financial models/errors, ledger/wallet provisioning metadata, platform service
+names, S3 configuration and WebSocket scaffolding. No default tenant or bypassing
+authorizer replaces them.
 
-Restored full backend guidelines and the backend-review skill, correcting scoped
-paths. Copied error constructors follow `merrors`; local adaptations also validate
-startup settings, preserve listen failures/nonzero exit, close Mongo after failed
-runtime creation and avoid logging database settings. Architecture checks enforce
-the project error model and public-only provider boundary.
+Retained Sendico source is pinned to `8bb20dcd622dd8eb92d289b6b34411e7eccab083`:
+HTTP runtime, local customer/password service and Mongo repository, customer
+sessions and verification storage, generic repository/transaction code, errors,
+logging and health. [Provenance](../backend/PROVENANCE.json) covers 232 retained
+Go files and 112 isolated public OpenAPI files; every adaptation is flagged.
+The Sendico checkout remains unchanged.
 
-The copied runtime installs local authentication transport and initializes the
-account service. Signup/profile endpoints, verification delivery/completion,
-initial local tenant/client provisioning, Flutter HTTP adapters and live Sendico
-calls remain future wiring. Public external-customer compliance/ownership gaps
-are documented; internal APIs are not an allowed workaround.
+Customer creation accepts a raw password, validates/hashes it and commits the
+customer and activation token together. Token transactions join an active outer
+customer transaction. Deletion revokes only the selected customer's sessions and
+deletes its account atomically, including when it is the final local customer.
+Customer lifecycle and login use the same configured auth collections. Pending,
+active and blocked customer state and session/client binding remain local.
 
-Validation: `make test` (race-enabled backend suite with real MongoDB containers,
-plus all frontend package/app tests), `make lint-backend` (architecture, gofmt,
-vet), `go build` and `git diff --check` passed. Local smoke used a disposable
-SXCHNGE Mongo replica set: health 200, invalid login 400, SIGTERM exit 0 and missing
-configuration exit 1. Earlier extraction failures were fixed: unused import,
-wrong example-config test path, an out-of-scope recipient migration test
-copied without its uncopied migration, and missing built-in policy records on
-fresh startup. The copied policy seed was run twice and retained three records. No security scan was requested or run.
+The sole Sendico organization reference belongs to the future public HTTP adapter
+configuration. [Architecture and capabilities](architecture/bff.md) document
+server-side customer/resource ownership and the public external-customer contract
+gaps. No internal service, shared database or provider resource creation is used.
+Signup/profile HTTP routes, verification delivery/completion, application client
+setup and live Sendico integration remain subsequent wiring work.
 
-Delivery: [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), branch `bff-34`
-into `main`; task #34 retains backend label, tech owner and SXCHNGE project.
-This entry supersedes the earlier new-shell/delegated-provisioning proposal.
+Backend completion review covered the retained copied runtime and the full
+extraction diff. Inactive-customer checks and refresh client/account binding were
+added after review; explicit response DTOs keep storage fields out of HTTP output.
+
+Validation passed: `make test` (race-enabled backend suite, including fresh Mongo
+replica-set customer lifecycle/runtime tests, plus all frontend suites),
+`make lint-backend` (architecture, formatting and vet), and
+`go test -tags integration -run '^$' ./...` from `backend` (compilation of the
+additional tagged suites; this command does not execute those tests).
+Provenance/source blobs, public contract references and `git diff --check` passed.
+Earlier extraction compile errors were corrected. The initial fresh-database test
+attempt used an unavailable image tag and then hit Docker Desktop replica-set
+address discovery; it now uses `mongo:8` and a direct connection to the disposable
+single-node replica set. No security scan was requested or run.
+
+PR #35 remains unmerged. There is no deployed-data migration: this bootstrap has
+not been deployed. Existing experimental databases may retain unused tenancy
+collections; this change does not delete external database records. Customer HTTP
+responses now expose only ID, name, last name, login, locale and optional avatar.
+The frontend still uses dummy services and is unchanged.