Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/admin-panel/src/router/index.ts

@@ -2,7 +2,7 @@
 import { createRouter, createWebHistory } from 'vue-router';
 import { adminRoute, fullPageAdminRoute } from './admin';
 import { branchRoute, fullPageBranchRoute } from './branch';
-import { isBranch, tokenName, userName } from '../utils';
+import { iamAppUrl, isBranch, tokenName, userName } from '../utils';
 import { useUsersStore } from '../stores/users';
 import api from '../api/client';
 
@@ -25,6 +25,12 @@ const router = createRouter({
       component: () => import('../layouts/full-page/FullPage.vue'),
       children: [
         ...(isBranch() ? fullPageBranchRoute : fullPageAdminRoute),
+        {
+          path: '/auth/iam/callback',
+          name: 'iam-callback',
+          component: () => import('../views/auth/IamCallback.vue'),
+          meta: { rule: 'editor' },
+        },
         {
           path: '/pages/error-404',
           name: 'page-error-404',
@@ -68,7 +74,7 @@ router.afterEach(() => {
 });
 
 // legacy router.js:156-161
-const noneAuthUrl = ['/auth/login', '/auth/forgot-password', '/auth/register', '/reg'];
+const noneAuthUrl = ['/auth/login', '/auth/forgot-password', '/auth/register', '/reg', '/auth/iam/callback'];
 
 /**
  * Port of legacy getPermission() (router.js:163-182).
@@ -109,6 +115,21 @@ async function getPermission(): Promise<string[] | undefined> {
  * equivalent and produces the same user-visible result.
  */
 router.beforeEach(async (to) => {
+  if (!localStorage.getItem(tokenName) && to.path !== '/auth/iam/callback' && sessionStorage.getItem('gb_admin_iam_sso_checked') !== '1') {
+    sessionStorage.setItem('gb_admin_iam_sso_checked', '1');
+    try {
+      const { data } = await api.get('admin/auth/sso/start', {
+        params: { redirect_uri: iamAppUrl('auth/iam/callback') },
+      });
+      if (data?.enabled && data.authorize_url) {
+        window.location.assign(data.authorize_url);
+        return false;
+      }
+    } catch {
+      // سامانه هویت برای این پنل تنظیم نشده
+    }
+  }
+
   if (noneAuthUrl.indexOf(to.path) > -1) {
     return true;
   }