Add shared HMAC+domain auth for remote SMS wallet API.

Products can authenticate with one shared secret and tenant domain instead of per-version tokens; Bearer token remains as fallback.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -26,6 +26,9 @@ CENTRAL_SMS_SECRET="replace-with-central-sms-secret"
 CENTRAL_SMS_HOST="superadmin"
 CENTRAL_SMS_PLATFORM="superadmin"
 
+# رمز مشترک SMS ریموت (HMAC + دامنه) — همان مقدار روی همه نسخه‌های همکار/خانگی
+SMS_REMOTE_SHARED_SECRET="replace-with-long-random-shared-secret"
+
 HAMKAR_DB_HOST=127.0.0.1
 HAMKAR_DB_PORT=3306
 HAMKAR_DB_USER=root