parity(api): port the reference price formula with tests; SMS + MON-08 reports

Adds computeVariantPrice(), a verbatim port of the live formula at
henza_server/app/Models/ProductVariant.php:183-190, with the per-customer
making-charge offset as an explicit input defaulting to 0. The three
superseded formulas commented out above it apply VAT to the whole price
and are deliberately not ported (D4).

11 unit tests assert against hand calculations derived from the PHP source
rather than from the implementation, covering: with and without the
offset, VAT on the non-metal portion only, floor-to-nearest-1000, the
extraPercent default of 7, and the equivalence between the app folding the
offset into percent_pay and the server deriving it. 18 tests pass overall.

Also adds the D0 name-split review report script (read-only) and two
investigations the owner asked for:

- SMS: the reference uses the Trez panel (smspanel.trez.ir, Sms.php:69,97)
  with production credentials committed to git (SEC-12 — rotate them). All
  12 message templates catalogued; env var names proposed; nothing
  implemented pending approval.
- MON-08: henza_pwa computes percent_pay, discount and rial_pay rather
  than asking the user (cart.vue:170-179, Mixins/product/index.ts:69-75),
  so Phase 2 item #1 is to derive them server-side and ignore the client's
  values. rash_weight stays read from the DB as a recorded deviation.

Records the owner's two new standing rules: migrations only through the
standard Prisma workflow, and every data deletion logged in CHANGELOG.

[ref: henza_server/app/Models/{ProductVariant,Sms}.php, henza_pwa/src/views/cart.vue]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/PROGRESS.md

@@ -10,8 +10,8 @@
 | **Phase** | Security hotfix — **stages 1 and 2 ✅ complete** |
 | **Branch** | `parity/security-hotfix` |
 | **Status** | Both stages done and verified live: **46/46** smoke assertions, **7/7** jest unit tests, typecheck + build clean on all three projects. |
-| **Next step** | Show the user the **D0 (firstName/lastName)** and **`percent`** migrations for approval, then start `01-ADMIN-MATRIX.md` field-by-field (D12) |
-| **Blocked on** | user approval of those two migrations before they run |
+| **Next step** | **Migrations are written and shown — awaiting approval to run them** (`migrate dev`), then `01-ADMIN-MATRIX.md` field-by-field (D12) |
+| **Blocked on** | approval to run the two migrations; approval to implement the SMS provider |
 | **Last updated** | 2026-09-22 |
 
 ### Security hotfix — final result
@@ -146,3 +146,29 @@ All user rulings live there (D0–D13). Highlights that change how work is done:
 | `_inv-tgt-userappv2.md` | apps/user-app-v2 | 700 |
 
 Consolidated into `00-INVENTORY.md`. Issues found: `ISSUES.md` (26 entries).
+
+## Standing rules added 2026-09-22
+
+1. **Migrations run only via the standard Prisma workflow** (`migrate dev` in
+   development). **`prisma db execute` is not used for schema changes.**
+2. **Every data deletion is logged in `CHANGELOG.md`** — including throwaway
+   rows created during a session.
+3. **D13** — the retail storefront is preserved but out of scope; see
+   `DECISIONS.md` §D13 and `PROTECTED.md` §H.
+
+## Phase 2 — item #1 (fixed by the MON-08 ruling)
+
+Before anything else in Phase 2: the server must derive `wagePercent`,
+`discountPercent` and `flatRialCharge` from the DB and **ignore** the client's
+values, because `henza_pwa` computes them rather than asking the user
+(`cart.vue:170-179`, `Mixins/product/index.ts:69-75`). A comparison test must
+show the total is unchanged for an ordinary customer. Depends on
+`makingChargeOffsetPercent` existing. Full reasoning: `DECISIONS.md`
+§"Report — MON-08".
+
+## Waiting on the owner (2026-09-22)
+
+| # | Item | What is ready |
+|---|---|---|
+| 1 | Run the **D0** and **percent** migrations | Both SQL files written, storefront impact assessed, backfill report script written, 11 unit tests passing. Command: `npx prisma migrate dev`. |
+| 2 | Implement the **SMS provider** (Trez) | Provider, all 12 templates and env-var names documented in `DECISIONS.md`. Nothing written yet. **SEC-12: the reference's committed credentials must be rotated.** |