chore(release): prepare release/delivery + fix docker env passthrough

DEPLOY-01: docker-compose.yml passed only DATABASE_URL and PORT to the api
service, so JWT_SECRET, JWT_CUSTOMER_SECRET, OTP_MASTER_CODE and every SMS_TREZ_*
variable were silently dropped in Docker. A deployed build would have used the
development JWT fallback and would not have had the delivery master code at all,
so the demo login would have failed with no obvious cause. All are now forwarded,
defaulting to empty (which the code treats as unset); verified with
`docker compose config`.

TEST-01: test-sales-expert-roundtrip.cjs had localhost:3077 hardcoded and could
only connect by accident. Now defaults to the repo's API_PORT. 33/33.

DELIVERY.md documents env vars (names only), run/deploy commands, how migrations
run inside the container, the verification results and the known issues.

release/delivery contains both parity branches with no conflicts (fast-forward).
build 5/5, jest 45/45, admin smoke 43/43, apps smoke 43/43, B2B scan 34/34,
B2B writes 25/25, auth-smoke 32/32, typecheck clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/shared-types/dist/index.d.ts

@@ -52,7 +52,15 @@ export interface CreateOrderItemDto {
     flatRialCharge?: number;
 }
 export interface CreateOrderDto {
-    customerId: string;
+    /**
+     * Ignored by the server, which takes the customer from the caller's token.
+     *
+     * It used to be required, on a public route, so anyone could place an order
+     * on any customer's account — landing on their gold debt and their ledger
+     * (SEC-02 in docs/parity/ISSUES.md). Optional here only so the two apps,
+     * which still send it, keep type-checking; both drop it in Phase 2.
+     */
+    customerId?: string;
     branchId?: string;
     items: CreateOrderItemDto[];
 }