Add SMS OTP, harden auth, and fix order/checkout server bugs.

Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/schema.prisma

@@ -210,6 +210,7 @@ model OtpChallenge {
   firstName  String?
   lastName   String?
   isRegister Boolean  @default(false)
+  attempts   Int      @default(0)
   expiresAt  DateTime
   createdAt  DateTime @default(now())