Phase 5 + all remaining

inventory-server/dashboard/acot-server/utils/phoneAuth.js

@@ -2,9 +2,9 @@
 // The acot-phone-server sends `x-acot-api-key` on every request; we compare
 // against ACOT_PHONE_API_KEY from the environment using timing-safe comparison.
 
-const crypto = require('crypto');
+import crypto from 'node:crypto';
 
-function requirePhoneApiKey(req, res, next) {
+export function requirePhoneApiKey(req, res, next) {
   const expected = process.env.ACOT_PHONE_API_KEY;
   if (!expected) {
     console.error('ACOT_PHONE_API_KEY not configured; rejecting all requests');
@@ -24,5 +24,3 @@ function requirePhoneApiKey(req, res, next) {
 
   next();
 }
-
-module.exports = { requirePhoneApiKey };