PASS 01 anonymous /customers is sent to /login
     server says: PHP 8.4 + PDO
PASS 02 login page has a form with a hidden token
PASS 03 wrong password: 401 and one neutral message
PASS 04 login without the token is refused (400 or 403)
PASS 05 cashier logs in and lands on /customers
PASS 06 all customers: 256 found, first 20 shown
PASS 07 search 'budi' finds 3
PASS 08 search by phone finds Nabila Rahman
PASS 09 search text is escaped, not executed
PASS 10 SQL typed into the search box is only text
PASS 11 new-bill form is shown to a cashier
PASS 12 new bill without the token is refused (400 or 403)
PASS 13 bad bill: 422 and three messages
PASS 14 good bill: redirect to /bills/<new id>
PASS 15 bill page: 3 kg express = Rp 36.000, queued, at Rungkut
     created B2954
PASS 16 unknown bill: 404
PASS 17 log out, and /customers is closed again
PASS 18 a washer may not open the new-bill form: 403
18 passed, 0 failed
