Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

dist/auth/auth.controller.d.ts

@@ -9,10 +9,10 @@ export declare class AuthController {
         service: string;
     };
     requestOtp(dto: RequestOtpDto): Promise<{
+        debugCode?: string | undefined;
         success: boolean;
         message: string;
         expiresAt: Date;
-        debugCode: string;
     }>;
     verifyOtp(dto: VerifyOtpDto): Promise<{
         accessToken: string;