Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -33,6 +33,7 @@ services:
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER:-fabric}:${POSTGRES_PASSWORD:-fabric123}@postgres:5432/${POSTGRES_DB:-fabric_trade}?schema=public
       PORT: ${PORT:-3000}
+      TZ: ${TZ:-Asia/Tehran}
     ports:
       - '127.0.0.1:${API_PORT:-8585}:3000'