Allow creating customers with only first or last name.

Password stays optional; missing password gets a random hash server-side.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/customers/customers.service.ts

@@ -499,13 +499,19 @@ export class CustomersService {
       }
     }
 
-    if (!existingUser && !dto.password) {
-      throw new BadRequestException('password is required for new users');
-    }
-
     const passwordHash = existingUser
       ? existingUser.passwordHash
-      : await bcrypt.hash(dto.password!, 10);
+      : await bcrypt.hash(
+          // Password optional: random unusable hash when omitted (OTP login still works).
+          dto.password?.trim() || randomBytes(32).toString('hex'),
+          10,
+        );
+
+    const firstName = dto.firstName?.trim() || null;
+    const lastName = dto.lastName?.trim() || null;
+    if (!firstName && !lastName) {
+      throw new BadRequestException('firstName or lastName is required');
+    }
 
     const membership = await this.prisma.$transaction(async (tx) => {
       const account =
@@ -515,8 +521,8 @@ export class CustomersService {
             cellNumber: dto.cellNumber,
             passwordHash,
             email: dto.email,
-            firstName: dto.firstName,
-            lastName: dto.lastName,
+            firstName,
+            lastName,
             firstNameEn: dto.firstNameEn?.trim() || null,
             lastNameEn: dto.lastNameEn?.trim() || null,
             cellVerifiedAt: new Date(),