Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/admin-panel/src/layouts/components/TheNavbar.vue

@@ -104,9 +104,9 @@ const displayName = computed(() => auth.user?.name ?? auth.user?.fullName ?? 'ک
 const initial = computed(() => displayName.value.trim().charAt(0) || 'ک');
 const canSeePermissions = computed(() => Boolean(users.hasPermission('user.permission')));
 
-function onLogout() {
-  auth.logout();
-  router.push('/auth/login');
+async function onLogout() {
+  const left = await auth.logout();
+  if (!left) router.push('/auth/login');
 }
 </script>
 

apps/admin-panel/src/router/index.ts

@@ -2,7 +2,7 @@
 import { createRouter, createWebHistory } from 'vue-router';
 import { adminRoute, fullPageAdminRoute } from './admin';
 import { branchRoute, fullPageBranchRoute } from './branch';
-import { isBranch, tokenName, userName } from '../utils';
+import { iamAppUrl, isBranch, tokenName, userName } from '../utils';
 import { useUsersStore } from '../stores/users';
 import api from '../api/client';
 
@@ -25,6 +25,12 @@ const router = createRouter({
       component: () => import('../layouts/full-page/FullPage.vue'),
       children: [
         ...(isBranch() ? fullPageBranchRoute : fullPageAdminRoute),
+        {
+          path: '/auth/iam/callback',
+          name: 'iam-callback',
+          component: () => import('../views/auth/IamCallback.vue'),
+          meta: { rule: 'editor' },
+        },
         {
           path: '/pages/error-404',
           name: 'page-error-404',
@@ -68,7 +74,7 @@ router.afterEach(() => {
 });
 
 // legacy router.js:156-161
-const noneAuthUrl = ['/auth/login', '/auth/forgot-password', '/auth/register', '/reg'];
+const noneAuthUrl = ['/auth/login', '/auth/forgot-password', '/auth/register', '/reg', '/auth/iam/callback'];
 
 /**
  * Port of legacy getPermission() (router.js:163-182).
@@ -109,6 +115,21 @@ async function getPermission(): Promise<string[] | undefined> {
  * equivalent and produces the same user-visible result.
  */
 router.beforeEach(async (to) => {
+  if (!localStorage.getItem(tokenName) && to.path !== '/auth/iam/callback' && sessionStorage.getItem('gb_admin_iam_sso_checked') !== '1') {
+    sessionStorage.setItem('gb_admin_iam_sso_checked', '1');
+    try {
+      const { data } = await api.get('admin/auth/sso/start', {
+        params: { redirect_uri: iamAppUrl('auth/iam/callback') },
+      });
+      if (data?.enabled && data.authorize_url) {
+        window.location.assign(data.authorize_url);
+        return false;
+      }
+    } catch {
+      // سامانه هویت برای این پنل تنظیم نشده
+    }
+  }
+
   if (noneAuthUrl.indexOf(to.path) > -1) {
     return true;
   }

apps/admin-panel/src/stores/auth.ts

@@ -1,7 +1,7 @@
 // Ported from legacy henza_admin/src/store/auth/moduleAuth.js
 import { defineStore } from 'pinia';
 import api from '../api/client';
-import { tokenName, userName } from '../utils';
+import { iamAppUrl, tokenName, userName } from '../utils';
 import { useUsersStore } from './users';
 import type { UserInfo } from './users';
 
@@ -67,6 +67,9 @@ export const useAuthStore = defineStore('auth', {
       delete persisted.ut;
 
       this.inject(persisted);
+      if (data.iamBootstrapUrl) {
+        window.location.assign(data.iamBootstrapUrl);
+      }
       return persisted;
     },
 
@@ -83,13 +86,28 @@ export const useAuthStore = defineStore('auth', {
      * its module-scoped `roles` survived a session change (bug #2). Clearing
      * both storage and the roles store is the fix for that.
      */
-    logout() {
+    async logout(): Promise<boolean> {
+      let central: string | null = null;
+      try {
+        const { data } = await api.get('admin/auth/sso/logout-url', {
+          params: { return_url: iamAppUrl('auth/login') },
+        });
+        central = data?.logout_url ?? null;
+      } catch {
+        central = null;
+      }
       localStorage.removeItem(tokenName);
       localStorage.removeItem(userName);
       localStorage.removeItem('login');
+      sessionStorage.removeItem('gb_admin_iam_sso_checked');
       const users = useUsersStore();
       users.deleteRoles();
       users.deleteUserInfo();
+      if (central) {
+        window.location.assign(central);
+        return true;
+      }
+      return false;
     },
   },
 });

apps/admin-panel/src/utils/index.ts

@@ -15,5 +15,12 @@ export function isBranch(): boolean {
 
 // Legacy stored the token under a different localStorage key per mode.
 // See henza_admin/src/axios.js:6 and router.js:173-174,188.
+/** آدرس همین پنل، با پیشوند /branch در حالت شعبه. */
+export function iamAppUrl(path: string) {
+  const base = import.meta.env.BASE_URL || '/';
+  const prefix = base.endsWith('/') ? base : `${base}/`;
+  return `${window.location.origin}${prefix}${path.replace(/^\//, '')}`;
+}
+
 export const tokenName = isBranch() ? 'branch_token' : 'token';
 export const userName = isBranch() ? 'branch_user' : 'user';

apps/admin-panel/src/views/auth/IamCallback.vue

@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { onMounted } from 'vue';
+import { useRouter } from 'vue-router';
+import api from '../../api/client';
+import { useAuthStore } from '../../stores/auth';
+
+const router = useRouter();
+const auth = useAuthStore();
+
+onMounted(async () => {
+  const params = new URLSearchParams(window.location.search);
+  sessionStorage.setItem('gb_admin_iam_sso_checked', '1');
+
+  if (params.get('error') || !params.get('code') || !params.get('state')) {
+    await router.replace('/auth/login');
+    return;
+  }
+
+  try {
+    const { data } = await api.post('admin/auth/sso/callback', {
+      code: params.get('code'),
+      state: params.get('state'),
+    });
+    const persisted = { ...data };
+    delete persisted.roles;
+    delete persisted.ut;
+    auth.inject(persisted);
+    await router.replace('/dashboard/ecommerce');
+  } catch {
+    await router.replace('/auth/login');
+  }
+});
+</script>
+
+<template>
+  <div style="min-height: 100vh; display: grid; place-items: center">در حال ورود...</div>
+</template>