Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

dist/common/utils/tehran-time.d.ts

@@ -0,0 +1,5 @@
+export declare function tehranCalendarDay(date: Date): Date;
+export declare function calendarDayOf(date: Date | string): Date;
+export declare function addDays(date: Date, days: number): Date;
+export declare function diffInDays(from: Date, to: Date): number;
+export declare function tehranAtHour(date: Date, hour: number): Date;