feat(brand): rebrand to Hedena Gold and bring main user-app chrome

Rename the brand, ship Hedena logos, persist login OTP text in the SMS list, and port home/nav/auth/theme polish from main while keeping expert customers intact.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/modules/customer-auth/customer-auth.service.ts

@@ -11,7 +11,7 @@ import {
   UnauthorizedException,
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
-import { AdminRole, CustomerKind, MessageAudience, Prisma, VerificationStep } from '@prisma/client';
+import { AdminRole, CustomerKind, Prisma, VerificationStep } from '@prisma/client';
 import * as bcrypt from 'bcryptjs';
 import { PrismaService } from '../../prisma/prisma.service';
 import {
@@ -887,10 +887,9 @@ export class CustomerAuthService {
       `رمز عبور یکبار مصرف شما جهت ورود به اپلیکیشن ${brandName()} ${code} می باشد\n` +
       `aMo6iFyUQaY`;
 
-    // persist:false — the real text carries the live code, and the admin SMS
-    // grid lists and searches `body` (SEC-11). The redacted audit row below
-    // takes its place.
-    const result = await this.sms.send(mobile, smsText, { persist: false });
+    // Persist the real OTP body so the admin SMS list can show login codes
+    // (owner request: operators need to read them; risk accepted).
+    const result = await this.sms.send(mobile, smsText);
 
     // Only outside production, and only when no gateway is configured, so a
     // deployment can never print live codes into its logs.
@@ -928,22 +927,6 @@ export class CustomerAuthService {
         HttpStatus.SERVICE_UNAVAILABLE,
       );
     }
-
-    // An audit row, NOT the message body.
-    //
-    // SmsMessage.body is listed and full-text searchable on the admin panel's
-    // SMS grid (admin-misc.service.ts:136 allows `body`, :135 searches it), so
-    // persisting the real text would show every live OTP to any operator
-    // holding the `sms` rid — and the whole point of hashing codeHash is that
-    // the code exists nowhere in readable form. The code is redacted here.
-    await this.prisma.smsMessage.create({
-      data: {
-        audience: MessageAudience.SINGLE_NUMBER,
-        recipients: mobile,
-        body: 'کد یکبار مصرف ورود (متن پیام ثبت نمی‌شود)',
-        sentCount: 1,
-      },
-    });
   }
 }