feat: complete device onboarding and mobile binding workflows

internal/httpapi/onboarding_customer_auth.go

@@ -0,0 +1,23 @@
+package httpapi
+
+import (
+	"data-terminal-cloud/internal/onboarding"
+	"net/http"
+	"strings"
+)
+
+func onboardingCustomerAuth(service *onboarding.Service, bearer, next http.Handler) http.Handler {
+	if service == nil {
+		return bearer
+	}
+	cookie := service.CustomerAuth(next)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := r.URL.Path
+		allowed := path == "/api/v1/me" || path == "/api/v1/households" || strings.HasPrefix(path, "/api/v1/households/") || strings.HasPrefix(path, "/api/v1/subjects/") || strings.HasPrefix(path, "/api/v1/devices/")
+		if r.Header.Get("Authorization") == "" && allowed {
+			cookie.ServeHTTP(w, r)
+			return
+		}
+		bearer.ServeHTTP(w, r)
+	})
+}