Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -68,6 +68,28 @@ services:
       # Admin mobiles told when a customer completes their profile (D22).
       # Blank = nobody is notified; the upload still succeeds.
       - PROFILE_ADMIN_MOBILES=${PROFILE_ADMIN_MOBILES:-}
+      # Central IAM. Read at process start from this container only.
+      # Frontends compute callback URLs from the browser origin, so these
+      # never belong in a Vite build. Blank stays off (env.ts treats "").
+      - IAM_ENABLED=${IAM_ENABLED:-}
+      - IAM_ISSUER=${IAM_ISSUER:-}
+      - IAM_CLIENT_ID=${IAM_CLIENT_ID:-}
+      - IAM_CLIENT_SECRET=${IAM_CLIENT_SECRET:-}
+      - IAM_TENANT_ID=${IAM_TENANT_ID:-}
+      - IAM_TENANT_SLUG=${IAM_TENANT_SLUG:-}
+      - IAM_LOGIN_DELEGATION=${IAM_LOGIN_DELEGATION:-}
+      - IAM_HTTP_TIMEOUT_MS=${IAM_HTTP_TIMEOUT_MS:-}
+      - IAM_REDIRECT_URI=${IAM_REDIRECT_URI:-}
+      - IAM_REDIRECT_URIS=${IAM_REDIRECT_URIS:-}
+      - IAM_BROWSER_RETURN_URL=${IAM_BROWSER_RETURN_URL:-}
+      - IAM_POST_LOGOUT_REDIRECT_URI=${IAM_POST_LOGOUT_REDIRECT_URI:-}
+      - IAM_ALLOWED_RETURN_URLS=${IAM_ALLOWED_RETURN_URLS:-}
+      - IAM_ADMIN_REDIRECT_URI=${IAM_ADMIN_REDIRECT_URI:-}
+      - IAM_ADMIN_REDIRECT_URIS=${IAM_ADMIN_REDIRECT_URIS:-}
+      - IAM_ADMIN_BROWSER_RETURN_URL=${IAM_ADMIN_BROWSER_RETURN_URL:-}
+      - IAM_ADMIN_POST_LOGOUT_REDIRECT_URI=${IAM_ADMIN_POST_LOGOUT_REDIRECT_URI:-}
+      - IAM_ADMIN_ALLOWED_RETURN_URLS=${IAM_ADMIN_ALLOWED_RETURN_URLS:-}
+      - AUTH_SESSION_TRACKING=${AUTH_SESSION_TRACKING:-}
     # No host ports — Dokploy/Traefik routes by domain to container port 3000
     expose:
       - "3000"