parity(apps+api): complete_profile in both apps [ref: henza_server Major/CustomerController::complete]

Ports "تکمیل پروفایل" end to end (D22).

API
- POST customer/me/complete-profile — three required document ids, the
  customer taken from the token, verification step set to the reference's
  LIVE value (approved outright; its `= 1` line is commented out at :83 in
  favour of `= 2` at :85). Both SMS messages byte-identical and non-blocking
  per D20.
- POST customer/me/documents — the reference let the app upload through the
  same file/create the admin used, inside its auth:api-customer group
  (routes/api.php:95); the target's copy is admin-guarded, so the page could
  not have uploaded at all. Reuses AdminUploadsService unchanged, so both
  paths share one size limit, MIME whitelist and naming scheme (UPL-01).
- PROFILE_ADMIN_MOBILES replaces the reference's four hardcoded personal
  numbers; blank means nobody is notified and the upload still succeeds.

Three reference behaviours deliberately NOT ported, all in ISSUES.md:
- SEC-14: `$customer->update($request->all())` mass-assigned the whole request
  body, letting the app write its own credit limit, making charge, gold debt,
  active flag or mobile. Replaced with a three-field whitelist.
- SEC-15: four real personal mobiles hardcoded in the source.
- APP-03: refresh()'s unterminated setInterval page reload.

Apps (both, template+script byte-identical, per-app styling only)
- CompleteProfileView + SingleImageUploader
- route /complete_profile, redirecting home once the documents are in, as the
  reference's guard did (router/index.ts:266)
- the entry point on the profile screen, shown only while they are missing
  (profile.vue:96-102)

Also (D23): JWT_CUSTOMER_SECRET now warns loudly at boot when unset. It falls
back to JWT_SECRET, which signs app and admin tokens with the same key and
leaves the `typ` check as the only barrier — and an expert's app token carries
their AdminUser id in `sub`. Warn rather than refuse to boot (D19, lowest
risk); DELIVERY.md lists it as the first pre-release step (REL-03).

Verified: build 5/5 · jest 45/45 · complete-profile 38/38 (new) ·
expert login 36/36 · apps smoke 43/43 · admin smoke 43/43 ·
B2B scan 34 ok/0 broken · typecheck clean on all four apps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/views/user/ProfileView.vue

@@ -60,12 +60,27 @@
         <Icon icon="vuesax-linear:user" size="26" />
         <p>اطلاعات حساب در دسترس نیست.</p>
       </section>
+      <!--
+        "تکمیل پروفایل" — the reference showed this button here, on the profile,
+        and only while sts_verify_step_two was neither 1 nor 2
+        (henza_pwa .../components/profile.vue:96-102). The same condition holds
+        here against the target VerificationStep enum.
+      -->
+      <button
+        v-if="canCompleteProfile"
+        type="button"
+        class="prof__complete"
+        @click="router.push({ name: 'completeProfile' })"
+      >
+        تکمیل پروفایل
+      </button>
     </container>
   </div>
 </template>
 
 <script setup lang="ts">
 import { computed, onMounted, ref } from 'vue'
+import { useRouter } from 'vue-router'
 import Icon from '../../components/icon/Icon.vue'
 import PageBar from '../../components/ui/PageBar.vue'
 import SectionHead from '../../components/home/SectionHead.vue'
@@ -85,6 +100,18 @@ const loading = ref(false)
 
 const isVerified = computed(() => customer.value?.verificationStep === 'VERIFIED')
 
+/**
+ * The reference gated the button on sts_verify_step_two being neither 1 nor 2,
+ * i.e. show it only while the documents have not been submitted. STEP_TWO_
+ * SUBMITTED and VERIFIED are those two states here.
+ */
+const canCompleteProfile = computed(() => {
+  const step = customer.value?.verificationStep
+  return Boolean(step) && step !== 'VERIFIED' && step !== 'STEP_TWO_SUBMITTED'
+})
+
+const router = useRouter()
+
 onMounted(async () => {
   if (!session.isLoggedIn) return
   loading.value = true
@@ -213,4 +240,18 @@ onMounted(async () => {
   margin: 0;
   font-size: 12.5px;
 }
+
+.prof__complete {
+  margin-top: 20px;
+  width: 100%;
+  padding: 14px;
+  border: none;
+  border-radius: 14px;
+  background: @ink;
+  color: #fff;
+  font-family: inherit;
+  font-size: 15px;
+  font-weight: 700;
+  cursor: pointer;
+}
 </style>