feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

- Add Tahesab/Zarrin accounting sync module with admin panel UI
- Add SMS relay driver as default provider, refactor SMS into driver pattern
- Update customer services, orders, products, and catalog queries
- Rebuild user-app and user-app-v2 dist assets
- Add Prisma migration for accounting tables
- Update docker-compose and env examples
- Update parity docs (DECISIONS, ISSUES, PROGRESS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -41,12 +41,21 @@ services:
       # Empty/unset disables it, which is the correct state for production.
       # See ISSUES REL-01. Must be exactly 4 digits to be typable in the apps.
       - OTP_MASTER_CODE=${OTP_MASTER_CODE:-}
-      # SMS. All blank = messages are logged, not sent; the API still boots (D20).
+      # SMS. All blank = the "relay" gateway with its built-in defaults (D26).
+      # A failed SMS never blocks the boot or an operation (D20).
       - SMS_PROVIDER=${SMS_PROVIDER:-}
+      - SMS_RELAY_URL=${SMS_RELAY_URL:-}
+      - SMS_RELAY_SECRET=${SMS_RELAY_SECRET:-}
+      - SMS_RELAY_HOST=${SMS_RELAY_HOST:-}
+      - SMS_RELAY_PLATFORM=${SMS_RELAY_PLATFORM:-}
       - SMS_TREZ_URL=${SMS_TREZ_URL:-}
       - SMS_TREZ_USERNAME=${SMS_TREZ_USERNAME:-}
       - SMS_TREZ_PASSWORD=${SMS_TREZ_PASSWORD:-}
       - SMS_TREZ_SENDER_LINE=${SMS_TREZ_SENDER_LINE:-}
+      # Accounting integration (D27): encrypts the token stored from the admin
+      # panel. Blank falls back to a JWT_SECRET-derived key with a warning.
+      - ACCOUNTING_SECRET_KEY=${ACCOUNTING_SECRET_KEY:-}
+      - ACCOUNTING_WORKER=${ACCOUNTING_WORKER:-}
       # Admin mobiles told when a customer completes their profile (D22).
       # Blank = nobody is notified; the upload still succeeds.
       - PROFILE_ADMIN_MOBILES=${PROFILE_ADMIN_MOBILES:-}