feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

- Add Tahesab/Zarrin accounting sync module with admin panel UI
- Add SMS relay driver as default provider, refactor SMS into driver pattern
- Update customer services, orders, products, and catalog queries
- Rebuild user-app and user-app-v2 dist assets
- Add Prisma migration for accounting tables
- Update docker-compose and env examples
- Update parity docs (DECISIONS, ISSUES, PROGRESS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -38,6 +38,20 @@ JWT_CUSTOMER_SECRET=
 # Customer token lifetime (default 30d).
 JWT_CUSTOMER_EXPIRES_IN=
 
+# ---------------------------------------------------------------------------
+# Accounting software integration (Tahesab / Zarrin, D27). Everything else —
+# which software, address, token, mappings — is set in the admin panel
+# («پیکر بندی ← اتصال حسابداری»), and the integration is off until then.
+# ---------------------------------------------------------------------------
+# Encrypts the accounting token at rest. Set a long random value. Blank falls
+# back to a key derived from JWT_SECRET (with a boot warning); changing that
+# key later means re-entering the token in the admin panel.
+ACCOUNTING_SECRET_KEY=
+# "off" keeps this API instance out of the background sync (only needed when
+# several instances run and you want exactly one doing it; a lease already
+# stops two from running the same job).
+ACCOUNTING_WORKER=
+
 # ---------------------------------------------------------------------------
 # Central IAM — delegated admin login (docs/iam-sso.md)
 # ---------------------------------------------------------------------------
@@ -88,12 +102,21 @@ AUTH_SESSION_TRACKING=
 OTP_MASTER_CODE=
 
 # ---------------------------------------------------------------------------
-# SMS gateway (Trez). Leave blank to disable sending: the server still boots,
-# messages are logged instead of sent, and customers cannot receive a login
-# code (D20). Never commit real values.
+# SMS gateway. The default "relay" driver works with everything blank (D26).
+# A failed SMS never stops the server or an operation (D20).
 # ---------------------------------------------------------------------------
-# "trez" (default) or "none" to disable explicitly.
+# "relay" (default), "trez", or "none" to disable explicitly.
 SMS_PROVIDER=
+# relay — the owner's createsms gateway. All four are optional.
+# URL and secret have built-in defaults.
+SMS_RELAY_URL=
+SMS_RELAY_SECRET=
+# The "host" field. Blank sends this machine's first external IPv4 — inside
+# Docker that is the container's address.
+SMS_RELAY_HOST=
+# "kave" (default, Kavenegar) or "default" to let the gateway pick the line.
+SMS_RELAY_PLATFORM=
+# trez — only used with SMS_PROVIDER=trez. Never commit real values.
 # Override only for staging; defaults to the provider's live endpoint.
 SMS_TREZ_URL=
 SMS_TREZ_USERNAME=