Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -18,8 +18,21 @@ RUN_SEED=false
 
 JWT_SECRET=change-me-to-a-long-random-string
 JWT_EXPIRES_IN=7d
-MOCK_OTP_CODE=123456
+MOCK_OTP_CODE=1234
 OTP_TTL_MINUTES=5
 
+# پیامک OTP (مثل آبشده خانگی — rayegansms / createsms)
+SMS_ENABLED=true
+SMS_API_URL=http://185.231.112.101/api/createsms
+SMS_SECRET_KEY=your-sms-secret-key
+SMS_PLATFORM=rayegansms
+SMS_HOST=پارچه
+SMS_APP_NAME=پارچه
+
+# سقف حجم بدنه JSON (تصاویر چک و رسید base64 هستند)
+BODY_LIMIT=25mb
+TZ=Asia/Tehran
+NODE_ENV=production
+
 NPM_REGISTRY=https://registry.npmmirror.com
 COMPOSE_BAKE=false