Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/migrations/20260808000000_otp_attempts/migration.sql

@@ -0,0 +1,2 @@
+-- شمارنده تلاش ناموفق برای جلوگیری از حدس‌زدن کد ۴ رقمی
+ALTER TABLE "OtpChallenge" ADD COLUMN "attempts" INTEGER NOT NULL DEFAULT 0;

prisma/schema.prisma

@@ -210,6 +210,7 @@ model OtpChallenge {
   firstName  String?
   lastName   String?
   isRegister Boolean  @default(false)
+  attempts   Int      @default(0)
   expiresAt  DateTime
   createdAt  DateTime @default(now())
 

prisma/seed.ts

@@ -636,7 +636,7 @@ async function main() {
   void order1;
   console.log('Seed completed successfully.');
   console.log('Admin login: 09121112222 / admin123');
-  console.log('Customer OTP login: 09121234567 / code 123456');
+  console.log('Customer OTP login: 09121234567 / code 1234');
 }
 
 main()