fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

With NODE_ENV=production (always, in the Docker image) the API lists
every problem at once and does not start while any of these holds:
- OTP_MASTER_CODE is set: the fixed test login signs in any customer. A
  test server built from the production image must say so with
  TEST_SERVER_ALLOW_MASTER_CODE=yes.
- JWT_CUSTOMER_SECRET is missing, equal to JWT_SECRET, or under 32
  characters.
- JWT_SECRET is missing, the published dev key, or under 32 characters.
- CORS_ORIGINS is empty, `*`, or not full origins. It no longer falls
  back to allow-all.

Checked live: a misconfigured start lists all four problems; a correct
one starts, answers the allowed origin, and blocks any other.
docs/SERVER-SETUP-CHECKLIST.md is the operator's list. DELIVERY.md,
docker-compose.yml and .env.example are updated to match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -31,21 +31,25 @@ services:
     environment:
       - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgres@db:5432/goldbank?schema=public}
       - PORT=${PORT:-3000}
-      # Auth. Without these the API falls back to a well-known development
-      # secret, so set them in the deployment environment.
+      # Auth. REQUIRED: the API refuses to start without both, each a random
+      # value of 32+ characters, and the two must differ (SEC-04, REL-03).
+      # See docs/SERVER-SETUP-CHECKLIST.md.
       - JWT_SECRET=${JWT_SECRET:-}
       - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-}
       - JWT_CUSTOMER_SECRET=${JWT_CUSTOMER_SECRET:-}
       - JWT_CUSTOMER_EXPIRES_IN=${JWT_CUSTOMER_EXPIRES_IN:-}
       # SEC-04: comma-separated browser origins allowed to call the API
-      # (e.g. https://adm.example.ir,https://app.example.ir). Blank = any.
+      # (e.g. https://adm.example.ir,https://app.example.ir). REQUIRED: the API
+      # refuses to start with it blank.
       - CORS_ORIGINS=${CORS_ORIGINS:-}
       # SEC-05: demo seed data is never created in production unless "true".
       - SEED_DEMO_DATA=${SEED_DEMO_DATA:-}
-      # ⚠ DELIVERY ONLY — a fixed OTP that signs in ANY active customer.
-      # Empty/unset disables it, which is the correct state for production.
-      # See ISSUES REL-01. Must be exactly 4 digits to be typable in the apps.
+      # ⚠ TEST SERVERS ONLY — a fixed OTP that signs in ANY active customer.
+      # Leave empty in production: the API refuses to start with it set unless
+      # TEST_SERVER_ALLOW_MASTER_CODE=yes, which only a test server may carry
+      # (REL-01). Must be exactly 4 digits to be typable in the apps.
       - OTP_MASTER_CODE=${OTP_MASTER_CODE:-}
+      - TEST_SERVER_ALLOW_MASTER_CODE=${TEST_SERVER_ALLOW_MASTER_CODE:-}
       # SMS. All blank = the "relay" gateway with its built-in defaults (D26).
       # A failed SMS never blocks the boot or an operation (D20).
       - SMS_PROVIDER=${SMS_PROVIDER:-}