test(api): live D20 verification + document every env var

Two live scripts against a running API, covering both halves of the master-OTP
contract:
  * with OTP_MASTER_CODE set (8/8): signs in, the JWT works on customer/me,
    Persian digits accepted, and the RULE E1 negatives — near-miss code,
    unknown mobile, inactive customer — all still rejected.
  * without it (6/6): the same code returns 401, no boot banner, a real code
    still logs in, and replaying it fails.

Also confirmed from the boot log that with no SMS credentials the server starts
normally and declines to send instead of erroring (D20).

.env.example gained the auth, SMS and upload variables, names only, no values,
with OTP_MASTER_CODE marked delivery-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/CHANGELOG.md

@@ -591,3 +591,23 @@ pass.**
 
 ### Data
 - No data was deleted or modified.
+
+### Live verification of D20 (against a running API, port 3000)
+
+Two scripts, both kept in `apps/api/scripts/`:
+
+- `test-master-otp-live.cjs` — API started **with** `OTP_MASTER_CODE`: **8/8**.
+  Signs the customer in, the JWT works on `GET customer/me`, Persian digits are
+  accepted (faToEn), and — the RULE E1 negatives — a near-miss code, an unknown
+  mobile and an inactive customer are all still rejected.
+- `test-master-otp-disabled.cjs` — API restarted **without** the variable:
+  **6/6**. The same master code now returns 401, the boot banner is absent, a
+  freshly requested real code still logs in, and replaying it fails (single use).
+
+Boot behaviour confirmed from the log: with no SMS credentials the server
+**started normally**, warned once, and `[dev] SMS not configured; not sending`
+appeared instead of an error — no operation was blocked (D20).
+
+**Data touched:** `test-master-otp-disabled.cjs` deletes the `CustomerOtp` rows
+**for its own test number only** (to clear the 60s resend cooldown); 1 row was
+deleted on the recorded run. No other data was created, changed or removed.