chore(release): prepare release/delivery + fix docker env passthrough

DEPLOY-01: docker-compose.yml passed only DATABASE_URL and PORT to the api
service, so JWT_SECRET, JWT_CUSTOMER_SECRET, OTP_MASTER_CODE and every SMS_TREZ_*
variable were silently dropped in Docker. A deployed build would have used the
development JWT fallback and would not have had the delivery master code at all,
so the demo login would have failed with no obvious cause. All are now forwarded,
defaulting to empty (which the code treats as unset); verified with
`docker compose config`.

TEST-01: test-sales-expert-roundtrip.cjs had localhost:3077 hardcoded and could
only connect by accident. Now defaults to the repo's API_PORT. 33/33.

DELIVERY.md documents env vars (names only), run/deploy commands, how migrations
run inside the container, the verification results and the known issues.

release/delivery contains both parity branches with no conflicts (fast-forward).
build 5/5, jest 45/45, admin smoke 43/43, apps smoke 43/43, B2B scan 34/34,
B2B writes 25/25, auth-smoke 32/32, typecheck clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -31,6 +31,22 @@ services:
     environment:
       - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgres@db:5432/goldbank?schema=public}
       - PORT=${PORT:-3000}
+      # Auth. Without these the API falls back to a well-known development
+      # secret, so set them in the deployment environment.
+      - JWT_SECRET=${JWT_SECRET:-}
+      - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-}
+      - JWT_CUSTOMER_SECRET=${JWT_CUSTOMER_SECRET:-}
+      - JWT_CUSTOMER_EXPIRES_IN=${JWT_CUSTOMER_EXPIRES_IN:-}
+      # ⚠ DELIVERY ONLY — a fixed OTP that signs in ANY active customer.
+      # Empty/unset disables it, which is the correct state for production.
+      # See ISSUES REL-01. Must be exactly 4 digits to be typable in the apps.
+      - OTP_MASTER_CODE=${OTP_MASTER_CODE:-}
+      # SMS. All blank = messages are logged, not sent; the API still boots (D20).
+      - SMS_PROVIDER=${SMS_PROVIDER:-}
+      - SMS_TREZ_URL=${SMS_TREZ_URL:-}
+      - SMS_TREZ_USERNAME=${SMS_TREZ_USERNAME:-}
+      - SMS_TREZ_PASSWORD=${SMS_TREZ_PASSWORD:-}
+      - SMS_TREZ_SENDER_LINE=${SMS_TREZ_SENDER_LINE:-}
     # No host ports — Dokploy/Traefik routes by domain to container port 3000
     expose:
       - "3000"