Build customers-api REST layer (Layer 3), mirroring catalog-api

8 routes over Customer + orders/payments sub-resources, proxying to
classic-models-api. openid-connect with RFC 8693 token exchange to
classic-models-api audience, rate-limiting, proxy-cache, audit-log —
same plugin set and structure as catalog-api's REST surface.

Not deployed: dev/gitrepository.yaml points at a gitea repo that
doesn't exist yet (kong-customers-api.git, 404). No MCP layer yet
either, unlike catalog-api.

kong/rest/audit-log-body-capture.yaml

@@ -0,0 +1,27 @@
+# dev only: captures raw request/response bodies into kong.ctx.shared for
+# audit-log.yaml's custom_fields_by_lua to read back in the log phase.
+# Drop this file (and its bindings) to stop body capture without touching
+# audit-log.yaml itself — it degrades gracefully to metadata-only logging.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end