Generate a cryptographically random 32-byte token and encode it for transport.
Compute the SHA-256 hash immediately; use the hash for database lookup and persistence.
Create the partner and token in the same transaction, passing the transaction context to both repository operations.
Send the raw token only through the backoffice-first-access notification.
Return only the partner ID from the creation use case and HTTP endpoint.
During password setup, validate the one-time PIN, hash the new password, clear the PIN, and invalidate pending first-access tokens in the same transaction.
Test response shape, email delivery, stored hash, expiry, transaction context, invalid credentials, and post-setup invalidation.
Run focused unit tests, the partner-management suite, type checking, formatting, and the relevant end-to-end tests.
