Ship 4-digit OTP with rate-limit attempts, Tehran-safe expiry/rass math, larger JSON body limit for check images, and safer order pricing/status guards. Include rebuilt dist for prebuilt deploy.
Co-authored-by: Cursor <cursoragent@cursor.com>
Build on the developer machine without Docker, commit dist/, and run on the server with Dockerfile.dist plus compose env_file.
Co-authored-by: Cursor <cursoragent@cursor.com>