Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.prebuilt.yml

@@ -28,11 +28,20 @@ services:
         condition: service_healthy
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER:-fabric}:${POSTGRES_PASSWORD:-fabric123}@postgres:5432/${POSTGRES_DB:-fabric_trade}?schema=public
-      JWT_SECRET: ${JWT_SECRET:-fabric-trade-dev-secret-change-me}
+      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
       JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-7d}
       PORT: 3000
-      MOCK_OTP_CODE: ${MOCK_OTP_CODE:-123456}
+      MOCK_OTP_CODE: ${MOCK_OTP_CODE:-1234}
       OTP_TTL_MINUTES: ${OTP_TTL_MINUTES:-5}
+      SMS_ENABLED: ${SMS_ENABLED:-true}
+      SMS_API_URL: ${SMS_API_URL:-http://185.231.112.101/api/createsms}
+      SMS_SECRET_KEY: ${SMS_SECRET_KEY:-}
+      SMS_PLATFORM: ${SMS_PLATFORM:-rayegansms}
+      SMS_HOST: ${SMS_HOST:-پارچه}
+      SMS_APP_NAME: ${SMS_APP_NAME:-پارچه}
+      BODY_LIMIT: ${BODY_LIMIT:-25mb}
+      TZ: ${TZ:-Asia/Tehran}
+      NODE_ENV: ${NODE_ENV:-production}
       RUN_SEED: ${RUN_SEED:-false}
     ports:
       - '127.0.0.1:${API_PORT:-3000}:3000'