feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

- Add Tahesab/Zarrin accounting sync module with admin panel UI
- Add SMS relay driver as default provider, refactor SMS into driver pattern
- Update customer services, orders, products, and catalog queries
- Rebuild user-app and user-app-v2 dist assets
- Add Prisma migration for accounting tables
- Update docker-compose and env examples
- Update parity docs (DECISIONS, ISSUES, PROGRESS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/.env.example

@@ -15,19 +15,28 @@ JWT_CUSTOMER_EXPIRES_IN=30d
 # ---------------------------------------------------------------------------
 # SMS gateway — Trez panel (port of henza_server/app/Models/Sms.php:57-82)
 # ---------------------------------------------------------------------------
-# NEVER commit real values. The reference hardcoded its live production
+# Trez: NEVER commit real values. The reference hardcoded its live production
 # credentials in the source (SEC-12); those are treated as compromised and are
 # not reused. Set the real values in .env, which is gitignored.
 #
-# In production the server REFUSES TO START when the three required variables
-# below are unset, because without them no customer can receive a login code.
-# Outside production it only warns, and OTP codes are logged locally instead.
+# The server always starts (D20). A misconfigured provider only warns, and
+# outside production OTP codes are then logged locally instead.
+# With nothing set, the relay driver SENDS REAL SMS (D26) — set
+# SMS_PROVIDER=none on a development machine that must not.
 
-# "trez" (default) or "none" to disable sending entirely.
-SMS_PROVIDER=trez
+# "relay" (default, D26), "trez", or "none" to disable sending entirely.
+SMS_PROVIDER=relay
+# relay — all optional; URL and secret have built-in defaults.
+SMS_RELAY_URL=
+SMS_RELAY_SECRET=
+# The "host" field; blank sends this machine's first external IPv4.
+SMS_RELAY_HOST=
+# "kave" (default, Kavenegar) or "default" to let the gateway pick the line.
+SMS_RELAY_PLATFORM=
+# trez — only used with SMS_PROVIDER=trez.
 # Defaults to the reference endpoint when unset; override for staging.
 SMS_TREZ_URL=
-# Required in production:
+# Required for trez:
 SMS_TREZ_USERNAME=
 SMS_TREZ_PASSWORD=
 # The panel's sender line — the `PhoneNumber` form field.
@@ -36,3 +45,9 @@ SMS_TREZ_SENDER_LINE=
 # hardcoded six mobile numbers across its controllers (STUB-05); empty means
 # no admin notifications are sent.
 SMS_ADMIN_RECIPIENTS=
+
+# Accounting integration (D27) — configured in the admin panel; these two only
+# protect the stored token and control the background worker.
+ACCOUNTING_SECRET_KEY=
+# "off" keeps this instance out of the background sync.
+ACCOUNTING_WORKER=