Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/release/seed.js

@@ -1607,6 +1607,9 @@ var ALL_RIDS = [
   "comment.state",
   "comment.view",
   "comment.view.edit",
+  // D27 — «اتصال حسابداری» (Tahesab / Zarrin). Not a legacy rid.
+  "config.accounting",
+  "config.wage",
   "config.report",
   "config.statics",
   "config.statics.brand",
@@ -1742,28 +1745,7 @@ var PLACEHOLDER_PASSWORD_HASH = hashSync(DEV_PASSWORD, 10);
 var DEV_TEST_PHONE = "09128081392";
 var DEV_TEST_PHONE_PASSWORD_HASH = hashSync(DEV_TEST_PHONE, 10);
 var PLACEHOLDER_PRODUCT_IMAGE = "/img/no-items.png";
-async function main() {
-  const [tehran, mashhad, isfahan, tabriz] = await Promise.all([
-    prisma.city.upsert({ where: { id: "city-tehran" }, update: {}, create: { id: "city-tehran", name: "\u062A\u0647\u0631\u0627\u0646", province: "\u062A\u0647\u0631\u0627\u0646" } }),
-    prisma.city.upsert({ where: { id: "city-mashhad" }, update: {}, create: { id: "city-mashhad", name: "\u0645\u0634\u0647\u062F", province: "\u062E\u0631\u0627\u0633\u0627\u0646 \u0631\u0636\u0648\u06CC" } }),
-    prisma.city.upsert({ where: { id: "city-isfahan" }, update: {}, create: { id: "city-isfahan", name: "\u0627\u0635\u0641\u0647\u0627\u0646", province: "\u0627\u0635\u0641\u0647\u0627\u0646" } }),
-    prisma.city.upsert({ where: { id: "city-tabriz" }, update: {}, create: { id: "city-tabriz", name: "\u062A\u0628\u0631\u06CC\u0632", province: "\u0622\u0630\u0631\u0628\u0627\u06CC\u062C\u0627\u0646 \u0634\u0631\u0642\u06CC" } })
-  ]);
-  const branchTehran = await prisma.branch.upsert({
-    where: { id: "branch-tehran-bazaar" },
-    update: {},
-    create: { id: "branch-tehran-bazaar", name: "\u0634\u0639\u0628\u0647 \u0628\u0627\u0632\u0627\u0631 \u0628\u0632\u0631\u06AF \u062A\u0647\u0631\u0627\u0646", cityId: tehran.id }
-  });
-  const branchMashhad = await prisma.branch.upsert({
-    where: { id: "branch-mashhad-main" },
-    update: {},
-    create: { id: "branch-mashhad-main", name: "\u0634\u0639\u0628\u0647 \u0645\u0631\u06A9\u0632\u06CC \u0645\u0634\u0647\u062F", cityId: mashhad.id }
-  });
-  await prisma.workshop.upsert({
-    where: { id: "workshop-central" },
-    update: {},
-    create: { id: "workshop-central", name: "\u06A9\u0627\u0631\u06AF\u0627\u0647 \u0645\u0631\u06A9\u0632\u06CC \u0633\u0627\u062E\u062A \u0637\u0644\u0627" }
-  });
+async function seedAccessControl() {
   const userTypes = [
     // Full access — every rid the routers gate.
     { id: 85, title: "\u0645\u062F\u06CC\u0631 \u0627\u0631\u0634\u062F", rids: ALL_RIDS },
@@ -1824,6 +1806,46 @@ async function main() {
       skipDuplicates: true
     });
   }
+}
+function demoDataAllowed() {
+  if (process.env.SEED_DEMO_DATA?.trim() === "true") return true;
+  return process.env.NODE_ENV !== "production";
+}
+async function main() {
+  await seedAccessControl();
+  if (!demoDataAllowed()) {
+    console.log("seed: production \u2014 roles and permissions only; demo data skipped (set SEED_DEMO_DATA=true to force)");
+    return;
+  }
+  const city = (id, name, parentId) => prisma.city.upsert({ where: { id }, update: {}, create: { id, name, parentId } });
+  await city("city-iran", "\u0627\u06CC\u0631\u0627\u0646", null);
+  await Promise.all([
+    city("city-prov-tehran", "\u0627\u0633\u062A\u0627\u0646 \u062A\u0647\u0631\u0627\u0646", "city-iran"),
+    city("city-prov-khorasan-razavi", "\u0627\u0633\u062A\u0627\u0646 \u062E\u0631\u0627\u0633\u0627\u0646 \u0631\u0636\u0648\u06CC", "city-iran"),
+    city("city-prov-isfahan", "\u0627\u0633\u062A\u0627\u0646 \u0627\u0635\u0641\u0647\u0627\u0646", "city-iran"),
+    city("city-prov-east-azarbaijan", "\u0627\u0633\u062A\u0627\u0646 \u0622\u0630\u0631\u0628\u0627\u06CC\u062C\u0627\u0646 \u0634\u0631\u0642\u06CC", "city-iran")
+  ]);
+  const [tehran, mashhad, isfahan, tabriz] = await Promise.all([
+    city("city-tehran", "\u062A\u0647\u0631\u0627\u0646", "city-prov-tehran"),
+    city("city-mashhad", "\u0645\u0634\u0647\u062F", "city-prov-khorasan-razavi"),
+    city("city-isfahan", "\u0627\u0635\u0641\u0647\u0627\u0646", "city-prov-isfahan"),
+    city("city-tabriz", "\u062A\u0628\u0631\u06CC\u0632", "city-prov-east-azarbaijan")
+  ]);
+  const branchTehran = await prisma.branch.upsert({
+    where: { id: "branch-tehran-bazaar" },
+    update: {},
+    create: { id: "branch-tehran-bazaar", name: "\u0634\u0639\u0628\u0647 \u0628\u0627\u0632\u0627\u0631 \u0628\u0632\u0631\u06AF \u062A\u0647\u0631\u0627\u0646", cityId: tehran.id }
+  });
+  const branchMashhad = await prisma.branch.upsert({
+    where: { id: "branch-mashhad-main" },
+    update: {},
+    create: { id: "branch-mashhad-main", name: "\u0634\u0639\u0628\u0647 \u0645\u0631\u06A9\u0632\u06CC \u0645\u0634\u0647\u062F", cityId: mashhad.id }
+  });
+  await prisma.workshop.upsert({
+    where: { id: "workshop-central" },
+    update: {},
+    create: { id: "workshop-central", name: "\u06A9\u0627\u0631\u06AF\u0627\u0647 \u0645\u0631\u06A9\u0632\u06CC \u0633\u0627\u062E\u062A \u0637\u0644\u0627" }
+  });
   await prisma.adminUser.upsert({
     where: { mobile: DEV_TEST_PHONE },
     update: { passwordHash: DEV_TEST_PHONE_PASSWORD_HASH, userTypeId: 85, branchId: null },