feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/services/customer_service.go

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package services
 
 import (
@@ -124,7 +126,15 @@ func (s *customerService) EnsureExternalCustomer(ctx *sqls.TxContext, externalUs
 		return 0, errorsx.UnauthorizedI18n("error.e0149")
 	}
 	now := time.Now()
-	if identity := repositories.CustomerIdentityRepository.GetBy(ctx.Tx, externalSource, externalID); identity != nil {
+	identity, err := repositories.CustomerIdentityRepository.GetUniqueBy(ctx.Tx, externalUser.IdentityScope, externalSource, externalID)
+	if err != nil {
+		return 0, errorsx.UnauthorizedI18n("error.e0161")
+	}
+	if identity != nil {
+		customer := repositories.CustomerRepository.Get(ctx.Tx, identity.CustomerID)
+		if customer == nil || customer.Status != enums.StatusOk {
+			return 0, errorsx.UnauthorizedI18n("error.e0161")
+		}
 		updates := map[string]any{
 			"last_active_at": now,
 			"updated_at":     now,
@@ -161,12 +171,16 @@ func (s *customerService) EnsureExternalCustomer(ctx *sqls.TxContext, externalUs
 	}
 	if err := repositories.CustomerIdentityRepository.Create(ctx.Tx, &models.CustomerIdentity{
 		CustomerID:     customer.ID,
+		IdentityScope:  externalUser.IdentityScope,
+		ScopedKey:      repositories.ScopedCustomerIdentityKey(externalUser.IdentityScope, externalSource, externalID),
 		ExternalSource: externalSource,
 		ExternalID:     externalID,
 		Status:         enums.StatusOk,
 		AuditFields:    utils.BuildAuditFields(nil),
 	}); err != nil {
-		return 0, err
+		// A concurrent scoped claim rolls the transaction back; retrying the
+		// exchange resolves the winning mapping. Do not expose SQL/key data.
+		return 0, errorsx.UnauthorizedI18n("error.e0161")
 	}
 	return customer.ID, nil
 }