update package-lock.json 050224

.env.example

@@ -9,9 +9,16 @@ DB_SYNC=true
 JWT_SECRET=change_me_to_a_long_random_secret
 OTP_HASH_SECRET=change_me_to_a_long_random_secret
 SUPER_ADMIN_MOBILE=09123456789
+# Min seconds between OTP requests for the same mobile
+OTP_REQUEST_COOLDOWN_SECONDS=60
+# Max OTP requests per mobile per rolling hour
+OTP_REQUEST_MAX_PER_HOUR=5
 # Dev/test only: returns OTP code in API response instead of sending SMS
 AUTH_RETURN_OTP=true
 
+# Comma-separated frontend origins (required in production for browser clients)
+# CORS_ORIGINS=https://app.example.com,http://localhost:5173
+
 # 0098sms.com — used when AUTH_RETURN_OTP is not true
 # From panel: account username, password (or web service password), approved sender line (FROM)
 SMS_USERNAME=