Lists customers for the authenticated retailer with cursor-based pagination on createdAt,
optional phone and sales person filters, and tenant isolation from the authorizer context.

Deprecated query parameters (where, order, offset) and invalid values (e.g. limit outside
[1, 100]) return 422. Default limit is 100 when omitted.