DOGNVASK-OP 4: when a new driver registers via the public QR-code
endpoint, the customer (dispatcher) is now notified by SMS with
approve/deny links the moment the driver is created — no longer only
after the driver completes their SMS setup.
- registerPublicSubuser() now calls seedPendingGrantAndNotifyDispatcher(),
which gets-or-creates the pending company grant, issues grant_approve
/ grant_deny action tokens, and SMSes the customer with the same
link structure the existing /subusers/access-decision flow already
consumes.
- seedPendingGrantAndNotifyDispatcher() is idempotent: if a previous
request is still live (unconsumed, unexpired tokens outstanding), the
SMS is skipped so a driver re-scanning the QR code does not spam the
dispatcher.
- /subusers/setup completion reuses the seeded grant and only re-pings
the dispatcher when no decision tokens are outstanding, so a fresh
flow (e.g. legacy scans) still notifies once.
- Public response stays uniform (no setup_token / customer_number
leaked), per existing contract.
- New contract tests assert the new code paths, helper methods, and
duplicate-guard semantics.
TRU-88 backend sub-agent
0e32e03da5