fix: updated the createdBy in plg onboarding (#2398)

## fix: stamp customer identity as `createdBy` on PLG onboarding for
pre-seeded records

### Problem

When a PLG onboarding record is pre-seeded by an admin with
`PRE_ONBOARDING` or `INACTIVE` status, the `createdBy` field is set to
`'system'` (or the admin identity). When the real customer later
triggers the onboarding flow for that domain, `updatedBy` correctly
captured their identity but `createdBy` remained as `'system'` —
misrepresenting who actually initiated the onboarding.

### Solution

In `performAsoPlgOnboarding`, after setting `updatedBy`, stamp
`createdBy` with the caller's identity when the existing record's status
is `PRE_ONBOARDING` or `INACTIVE`. These are the two statuses that
indicate a record was pre-seeded before the customer triggered the flow.

```js
onboarding.setUpdatedBy(callerIdentity);
if ([STATUSES.PRE_ONBOARDING, STATUSES.INACTIVE].includes(onboarding.getStatus())) {
  onboarding.setCreatedBy(callerIdentity);
}
```

### Changes

- **`src/controllers/plg/plg-onboarding.js`** — sets `createdBy` to the
real caller identity when resuming a `PRE_ONBOARDING` or `INACTIVE`
record
- **`test/controllers/plg/plg-onboarding.test.js`** — adds 3 unit tests
covering PRE_ONBOARDING, INACTIVE, and the no-op case for other statuses

### Testing

- All 330 unit tests pass
- Covered scenarios:
  - `PRE_ONBOARDING` record → `createdBy` updated to customer email
  - `INACTIVE` record → `createdBy` updated to customer email
  - Any other status (e.g. `IN_PROGRESS`) → `createdBy` left unchanged


Please ensure your pull request adheres to the following guidelines:
- [ ] make sure to link the related issues in this description. Or if
there's no issue created, make sure you
  describe here the problem you're solving.
- [ ] when merging / squashing, make sure the fixed issue references are
visible in the commits, for easy compilation of release notes

If the PR is changing the API specification:
- [ ] make sure you add a "Not implemented yet" note the endpoint
description, if the implementation is not ready
yet. Ideally, return a 501 status code with a message explaining the
feature is not implemented yet.
- [ ] make sure you add at least one example of the request and
response.

If the PR is changing the API implementation or an entity exposed
through the API:
- [ ] make sure you update the API specification and the examples to
reflect the changes.

If the PR is introducing a new audit type:
- [ ] make sure you update the API specification with the type, schema
of the audit result and an example

## Related Issues


Thanks for contributing!

Co-authored-by: Anshul Kumar <anshulk@Anshuls-MacBook-Pro-2.local>

Author: anshulk-public

src/controllers/plg/plg-onboarding.js

@@ -704,6 +704,9 @@ async function performAsoPlgOnboarding({
     }
   }
   onboarding.setUpdatedBy(callerIdentity);
+  if ([STATUSES.PRE_ONBOARDING, STATUSES.INACTIVE].includes(onboarding.getStatus())) {
+    onboarding.setCreatedBy(callerIdentity);
+  }
 
   // Guard: only one domain per IMS org can be onboarded
   const existingRecords = await PlgOnboarding.allByImsOrgId(imsOrgId);

test/controllers/plg/plg-onboarding.test.js

@@ -3209,6 +3209,32 @@ describe('PlgOnboardingController', function describePlgOnboarding() {
       expect(mockOnboarding.setStatus).to.have.been.calledWith('ONBOARDED');
     });
 
+    it('stamps customer identity as createdBy when existing record is PRE_ONBOARDING', async () => {
+      mockOnboarding.getStatus.returns('PRE_ONBOARDING');
+      const authInfo = { getProfile: sandbox.stub().returns({ tenants: [{ id: 'AAAAAAAABBBBBBBBCCCCCCCC' }], email: 'customer@example.com' }) };
+      const context = buildContext({ domain: TEST_DOMAIN }, { authInfo });
+      const res = await controller.onboard(context);
+      expect(res.status).to.equal(200);
+      expect(mockOnboarding.setCreatedBy).to.have.been.calledWith('customer@example.com');
+    });
+
+    it('stamps customer identity as createdBy when existing record is INACTIVE', async () => {
+      mockOnboarding.getStatus.returns('INACTIVE');
+      const authInfo = { getProfile: sandbox.stub().returns({ tenants: [{ id: 'AAAAAAAABBBBBBBBCCCCCCCC' }], email: 'customer@example.com' }) };
+      const context = buildContext({ domain: TEST_DOMAIN }, { authInfo });
+      const res = await controller.onboard(context);
+      expect(res.status).to.equal(200);
+      expect(mockOnboarding.setCreatedBy).to.have.been.calledWith('customer@example.com');
+    });
+
+    it('does not overwrite createdBy when status is not PRE_ONBOARDING or INACTIVE', async () => {
+      mockOnboarding.getStatus.returns('IN_PROGRESS');
+      const context = buildContext({ domain: TEST_DOMAIN });
+      const res = await controller.onboard(context);
+      expect(res.status).to.equal(200);
+      expect(mockOnboarding.setCreatedBy).to.not.have.been.called;
+    });
+
     it('allows onboarding when other domains exist but none are onboarded', async () => {
       const waitlistedRecord = createMockOnboarding({
         id: 'other-onboarding-id',