Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -60,7 +60,7 @@ RUN_SEED=true docker compose up -d
 | نقش | ورود | رمز / OTP |
 |------|------|-----------|
 | ادمین | `09121112222` | `admin123` |
-| مشتری | `09121234567` | OTP: `123456` |
+| مشتری | `09121234567` | OTP پیامکی (۴ رقم) — با `SMS_ENABLED=false` کد ثابت: `1234` |
 
 ## متغیرهای محیطی
 
@@ -71,8 +71,14 @@ DATABASE_URL=postgresql://fabric:fabric123@localhost:5432/fabric_trade?schema=pu
 JWT_SECRET=fabric-trade-dev-secret-change-me
 JWT_EXPIRES_IN=7d
 PORT=3000
-MOCK_OTP_CODE=123456
+MOCK_OTP_CODE=1234
 OTP_TTL_MINUTES=5
+SMS_ENABLED=true
+SMS_API_URL=http://185.231.112.101/api/createsms
+SMS_SECRET_KEY=...
+SMS_PLATFORM=rayegansms
+SMS_HOST=پارچه
+SMS_APP_NAME=پارچه
 ```
 
 ## اسکریپت‌ها