Add shared HMAC+domain auth for remote SMS wallet API.

Products can authenticate with one shared secret and tenant domain instead of per-version tokens; Bearer token remains as fallback.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/sms/remote-sms.controller.ts

@@ -1,6 +1,6 @@
 import { Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
 import { RemoteTenant } from '../auth/remote-tenant.decorator';
-import { RemoteTokenGuard } from '../auth/remote-token.guard';
+import { RemoteSmsAuthGuard } from '../auth/remote-sms-auth.guard';
 import { RemoteSmsConsumeDto } from './dto/sms-account.dto';
 import { SmsService } from './sms.service';
 
@@ -13,14 +13,17 @@ type RemoteTenantInfo = {
 };
 
 /**
- * Product apps (Hamkar/Khanegi) → SuperAdmin SMS wallet.
- * Auth: Authorization: Bearer {Tenant.remoteApiToken}
+ * Product apps → SuperAdmin SMS wallet.
+ *
+ * Auth (preferred): shared HMAC
+ *   X-Abshode-Domain, X-Abshode-Timestamp, X-Abshode-Signature
+ * Fallback: Authorization Bearer {Tenant.remoteApiToken}
  *
  * GET  /api/remote/sms/status?parts=1
  * POST /api/remote/sms/consume
  */
 @Controller('remote/sms')
-@UseGuards(RemoteTokenGuard)
+@UseGuards(RemoteSmsAuthGuard)
 export class RemoteSmsController {
   constructor(private readonly smsService: SmsService) {}