Remove user-app v1 and ship pending order, auth, and app fixes.

Drop the duplicate customer app from the monorepo and keep user-app-v2 as the only app; include order pricing, admin cart, OTP/SMS, and dashboard cache updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/modules/sms/sms.service.ts

@@ -17,9 +17,6 @@ import { isPrivateIpv4, resolveRelayHost } from './drivers/relay.driver';
  *   * EVERY message is persisted, via `Sms::set()` (`:80`)
  *   * the response body is returned and the callers ignore it
  *
- * The OTP message body is NOT persisted in readable form — see
- * CustomerAuthService.deliver() and SEC-11.
- *
  * Failure handling matches the reference: `Sms::Send` is called inline and its
  * result is discarded, so a failed send never aborted the order, the document
  * approval or the customer creation that triggered it. `send()` therefore
@@ -31,7 +28,7 @@ export type { SmsSendResult } from './drivers';
 export interface SmsSendOptions {
   /**
    * Persist the message body. Default true, matching `Sms::set()`.
-   * OTP delivery passes false and writes its own redacted row (SEC-11).
+   * Pass false only when the caller writes its own audit row.
    */
   persist?: boolean;
   audience?: MessageAudience;