fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

- production refuses to boot without JWT_SECRET instead of signing
  admin tokens with the published development key
- CORS_ORIGINS restricts browser callers; blank keeps allow-all with a
  production warning so a running deployment is not cut off
- the boot-time seed creates only roles and permissions in production;
  the demo customers, orders, debt and known-password accounts need
  SEED_DEMO_DATA=true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -37,6 +37,11 @@ services:
       - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-}
       - JWT_CUSTOMER_SECRET=${JWT_CUSTOMER_SECRET:-}
       - JWT_CUSTOMER_EXPIRES_IN=${JWT_CUSTOMER_EXPIRES_IN:-}
+      # SEC-04: comma-separated browser origins allowed to call the API
+      # (e.g. https://adm.example.ir,https://app.example.ir). Blank = any.
+      - CORS_ORIGINS=${CORS_ORIGINS:-}
+      # SEC-05: demo seed data is never created in production unless "true".
+      - SEED_DEMO_DATA=${SEED_DEMO_DATA:-}
       # ⚠ DELIVERY ONLY — a fixed OTP that signs in ANY active customer.
       # Empty/unset disables it, which is the correct state for production.
       # See ISSUES REL-01. Must be exactly 4 digits to be typable in the apps.