Fix mobile validation, cascade delete for businesses/categories, and DB error handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,7 +1,9 @@
 DB_HOST=127.0.0.1
+# Local Docker (docker compose up -d): 5432
+# Remote DB via SSH tunnel (-L 5433:127.0.0.1:5432): 5433
 POSTGRES_PORT=5432
 POSTGRES_USER=montime
-POSTGRES_PASSWORD=change_me
+POSTGRES_PASSWORD=montime
 POSTGRES_DB=montime
 # Dev only: auto-sync schema from entities (do not use true in production)
 DB_SYNC=true
@@ -17,7 +19,8 @@ OTP_REQUEST_MAX_PER_HOUR=5
 AUTH_RETURN_OTP=true
 
 # Comma-separated frontend origins (required in production for browser clients)
-# CORS_ORIGINS=https://app.example.com,http://localhost:5173
+# Include both dev ports if calling API directly (without Vite /api proxy)
+CORS_ORIGINS=https://montime.ir,https://adm.montime.ir,http://localhost:5173,http://localhost:5174
 
 # 0098sms.com — used when AUTH_RETURN_OTP is not true
 # From panel: account username, password (or web service password), approved sender line (FROM)