test(api): live D20 verification + document every env var

Two live scripts against a running API, covering both halves of the master-OTP
contract:
  * with OTP_MASTER_CODE set (8/8): signs in, the JWT works on customer/me,
    Persian digits accepted, and the RULE E1 negatives — near-miss code,
    unknown mobile, inactive customer — all still rejected.
  * without it (6/6): the same code returns 401, no boot banner, a real code
    still logs in, and replaying it fails.

Also confirmed from the boot log that with no SMS credentials the server starts
normally and declines to send instead of erroring (D20).

.env.example gained the auth, SMS and upload variables, names only, no values,
with OTP_MASTER_CODE marked delivery-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -23,3 +23,44 @@ USER_APP_V2_PORT=5182
 
 # API Configuration (kept for any tooling that still reads bare PORT)
 PORT=3000
+
+# ---------------------------------------------------------------------------
+# Authentication
+# ---------------------------------------------------------------------------
+# Admin JWT signing secret. REQUIRED in any real deployment — without it the
+# API falls back to a well-known development string.
+JWT_SECRET=
+# Admin token lifetime (default 12h).
+JWT_EXPIRES_IN=
+# Customer JWT signing secret. Deliberately SEPARATE from JWT_SECRET so an
+# admin token can never validate as a customer token (T1).
+JWT_CUSTOMER_SECRET=
+# Customer token lifetime (default 30d).
+JWT_CUSTOMER_EXPIRES_IN=
+
+# ---------------------------------------------------------------------------
+# ⚠ DELIVERY ONLY — REMOVE BEFORE THE REAL RELEASE (D20 / ISSUES REL-01)
+# ---------------------------------------------------------------------------
+# A fixed OTP that signs in ANY active customer, alongside the real code.
+# Leave it EMPTY or unset to disable it completely — that is the correct state
+# for production. While it is set, the API prints a warning banner at boot.
+OTP_MASTER_CODE=
+
+# ---------------------------------------------------------------------------
+# SMS gateway (Trez). Leave blank to disable sending: the server still boots,
+# messages are logged instead of sent, and customers cannot receive a login
+# code (D20). Never commit real values.
+# ---------------------------------------------------------------------------
+# "trez" (default) or "none" to disable explicitly.
+SMS_PROVIDER=
+# Override only for staging; defaults to the provider's live endpoint.
+SMS_TREZ_URL=
+SMS_TREZ_USERNAME=
+SMS_TREZ_PASSWORD=
+SMS_TREZ_SENDER_LINE=
+
+# ---------------------------------------------------------------------------
+# Uploads
+# ---------------------------------------------------------------------------
+# Absolute path for uploaded files; defaults to <api>/storage/uploads.
+UPLOAD_DIR=