Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -3,6 +3,7 @@ FROM node:22-bookworm
 WORKDIR /app
 
 ENV NODE_ENV=production
+ENV TZ=Asia/Tehran
 
 COPY deploy-bundle.tar.gz /tmp/deploy-bundle.tar.gz
 RUN tar -xzf /tmp/deploy-bundle.tar.gz -C /app \