fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

With NODE_ENV=production (always, in the Docker image) the API lists
every problem at once and does not start while any of these holds:
- OTP_MASTER_CODE is set: the fixed test login signs in any customer. A
  test server built from the production image must say so with
  TEST_SERVER_ALLOW_MASTER_CODE=yes.
- JWT_CUSTOMER_SECRET is missing, equal to JWT_SECRET, or under 32
  characters.
- JWT_SECRET is missing, the published dev key, or under 32 characters.
- CORS_ORIGINS is empty, `*`, or not full origins. It no longer falls
  back to allow-all.

Checked live: a misconfigured start lists all four problems; a correct
one starts, answers the allowed origin, and blocks any other.
docs/SERVER-SETUP-CHECKLIST.md is the operator's list. DELIVERY.md,
docker-compose.yml and .env.example are updated to match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -9,6 +9,7 @@ import { prepareDatabase } from './prisma/bootstrap';
 import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
 import { assertSmsConfigured } from './modules/sms/sms.service';
 import { envOr, envOrNull } from './common/env';
+import { parseCorsOrigins, productionConfigProblems } from './common/production-checks';
 import { masterOtpCode, masterOtpEnabled } from './modules/customer-auth/customer-auth.service';
 
 // serve-static's bundled `mime` version predates .avif, so it falls back to
@@ -19,41 +20,35 @@ const EXTRA_MIME_TYPES: Record<string, string> = {
 };
 
 /**
- * SEC-04 — production must not run on the published development key. Both JWT
- * modules fall back to 'dev-only-insecure-secret' (a string anyone can read
- * in this repository), with which anyone could mint an admin token. Outside
- * production that fallback is kept, so a fresh checkout still runs.
+ * REL-01, REL-03, SEC-04 — a production server does not start until its keys,
+ * allowed origins and the fixed test login are right. Every problem is listed
+ * at once, so one restart fixes them all. Outside production nothing is
+ * checked and the development fallbacks keep a fresh checkout running.
+ * The rules live in common/production-checks.ts.
  */
-function assertProductionSecrets() {
-  if (process.env.NODE_ENV !== 'production') return;
-  if (!envOrNull('JWT_SECRET')) {
-    throw new Error(
-      'JWT_SECRET تنظیم نشده است — سرور در حالت production بدون آن اجرا نمی‌شود.\n' +
-        'JWT_SECRET is not set: refusing to start in production on the public development key.',
-    );
-  }
+function assertProductionConfig() {
+  const problems = productionConfigProblems(process.env);
+  if (!problems.length) return;
+  throw new Error(
+    '\nسرور در حالت production اجرا نمی‌شود تا این موارد درست شوند:\n' +
+      'Refusing to start in production until these are fixed:\n' +
+      problems.map((p) => '  • ' + p).join('\n') +
+      '\n(see docs/SERVER-SETUP-CHECKLIST.md)\n',
+  );
 }
 
 /**
  * SEC-04 — which sites may call the API from a browser. CORS_ORIGINS is a
  * comma-separated list of exact origins (e.g. https://adm.example.ir,https://app.example.ir).
- * Unset keeps the old allow-all, with a warning in production, so an existing
- * deployment keeps working until the list is filled in.
+ * Required in production (assertProductionConfig); unset elsewhere = allow-all.
  */
 function corsOrigins(): string[] | true {
-  const list = (envOrNull('CORS_ORIGINS') ?? '')
-    .split(',')
-    .map((o) => o.trim().replace(/\/+$/, ''))
-    .filter(Boolean);
-  if (list.length) return list;
-  if (process.env.NODE_ENV === 'production') {
-    console.warn('⚠  CORS_ORIGINS تنظیم نشده — هر سایتی می‌تواند به API درخواست بفرستد. / CORS_ORIGINS is not set: any website may call this API.');
-  }
-  return true;
+  const list = parseCorsOrigins(envOrNull('CORS_ORIGINS') ?? '');
+  return list.length ? list : true;
 }
 
 async function bootstrap() {
-  assertProductionSecrets();
+  assertProductionConfig();
 
   // D20 — reports the SMS configuration and never throws. A missing credential
   // no longer stops the boot; messages are logged instead of sent.