feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

- Add Tahesab/Zarrin accounting sync module with admin panel UI
- Add SMS relay driver as default provider, refactor SMS into driver pattern
- Update customer services, orders, products, and catalog queries
- Rebuild user-app and user-app-v2 dist assets
- Add Prisma migration for accounting tables
- Update docker-compose and env examples
- Update parity docs (DECISIONS, ISSUES, PROGRESS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/modules/admin-misc/admin-misc.controller.ts

@@ -13,6 +13,7 @@ import { AdminMiscService } from './admin-misc.service';
 import { TableQueryDto } from '../admin-table/table-query.dto';
 import { CurrentAdmin, RequirePermission } from '../auth/guards';
 import type { AuthenticatedAdmin } from '../auth/jwt.strategy';
+import { isAccountingSettingKey } from '../accounting-sync/accounting-config';
 
 /**
  * Cities, SMS, notifications, newsletter, activity log and settings — the
@@ -227,7 +228,7 @@ export class AdminMiscController {
   // `custom.config.statics.slider`) simply by calling `const/mobile_main_slider`
   // directly, since the underlying Setting row is keyed the same either way.
   private assertNotSliderKey(key: string) {
-    if (key === 'mobile_main_slider') {
+    if (key === 'mobile_main_slider' || isAccountingSettingKey(key)) {
       throw new ForbiddenException('این تنظیم فقط از مسیر اختصاصی خود قابل دسترسی است');
     }
   }

apps/api/src/modules/admin-misc/admin-misc.service.ts

@@ -3,6 +3,7 @@ import { MessageAudience, Prisma } from '@prisma/client';
 import { PrismaService } from '../../prisma/prisma.service';
 import { TableService } from '../admin-table/table.service';
 import type { TableQueryDto } from '../admin-table/table-query.dto';
+import { ACCOUNTING_SETTING_PREFIX } from '../accounting-sync/accounting-config';
 
 /**
  * The remaining admin screens — legacy views/city, views/sms, views/notify,
@@ -477,7 +478,13 @@ export class AdminMiscService {
   }
 
   async listConsts() {
-    const rows = await this.prisma.setting.findMany({ orderBy: { key: 'asc' } });
+    // The accounting integration's rows (connection, encrypted token, worker
+    // lease) have their own `config.accounting` screen and never appear here
+    // (D27); the single-key routes refuse them in the controller.
+    const rows = await this.prisma.setting.findMany({
+      where: { NOT: { key: { startsWith: ACCOUNTING_SETTING_PREFIX } } },
+      orderBy: { key: 'asc' },
+    });
     return rows.map((r) => ({ key: r.key, value: r.value, updated_at: r.updatedAt }));
   }