Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/release/migrations/20261005120000_accounting_integration/migration.sql

@@ -0,0 +1,110 @@
+-- Accounting integration (D27): Tahesab / Zarrin, chosen in the admin panel.
+-- Plan: docs/ACCOUNTING-INTEGRATION-PLAN.md.
+--
+-- Adds the link table (app row <-> accounting record), the outbox the push
+-- jobs run from, the issue list pulls report into, and the cached balance and
+-- stock columns read back from the accounting software. Nothing existing
+-- changes meaning: goldDebtGrams/fiatDebtRial stay the internal ledger caches.
+
+-- CreateEnum
+CREATE TYPE "AccountingEntityType" AS ENUM ('CUSTOMER', 'PRODUCT');
+
+-- CreateEnum
+CREATE TYPE "AccountingOutboxKind" AS ENUM ('CUSTOMER_PUSH', 'PRODUCT_PUSH', 'ORDER_DOCUMENT', 'ORDER_DOCUMENT_DELETE');
+
+-- CreateEnum
+CREATE TYPE "AccountingOutboxStatus" AS ENUM ('PENDING', 'SENDING', 'SENT', 'FAILED', 'NEEDS_REVIEW', 'RESOLVED');
+
+-- AlterTable
+ALTER TABLE "Customer" ADD COLUMN     "accountingBalanceAt" TIMESTAMP(3),
+ADD COLUMN     "accountingGoldBalance" DECIMAL(14,4),
+ADD COLUMN     "accountingRialBalance" DECIMAL(20,2);
+
+-- AlterTable
+ALTER TABLE "Product" ADD COLUMN     "accountingStockAt" TIMESTAMP(3),
+ADD COLUMN     "accountingStockCount" DECIMAL(14,4),
+ADD COLUMN     "accountingStockWeight" DECIMAL(14,4);
+
+-- CreateTable
+CREATE TABLE "AccountingLink" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "entityType" "AccountingEntityType" NOT NULL,
+    "entityId" TEXT NOT NULL,
+    "externalCode" TEXT NOT NULL,
+    "externalName" TEXT,
+    "origin" TEXT NOT NULL,
+    "snapshot" JSONB,
+    "syncedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AccountingLink_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AccountingOutbox" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "kind" "AccountingOutboxKind" NOT NULL,
+    "entityId" TEXT NOT NULL,
+    "status" "AccountingOutboxStatus" NOT NULL DEFAULT 'PENDING',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "nextAttemptAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastError" TEXT,
+    "externalRef" TEXT,
+    "progress" JSONB,
+    "lastRequest" JSONB,
+    "lastResponse" JSONB,
+    "sentAt" TIMESTAMP(3),
+    "resolvedById" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AccountingOutbox_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AccountingIssue" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "externalCode" TEXT NOT NULL,
+    "entityId" TEXT,
+    "message" TEXT NOT NULL,
+    "data" JSONB,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "resolvedAt" TIMESTAMP(3),
+
+    CONSTRAINT "AccountingIssue_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AccountingLink_entityType_entityId_idx" ON "AccountingLink"("entityType", "entityId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AccountingLink_provider_entityType_entityId_key" ON "AccountingLink"("provider", "entityType", "entityId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AccountingLink_provider_entityType_externalCode_key" ON "AccountingLink"("provider", "entityType", "externalCode");
+
+-- CreateIndex
+CREATE INDEX "AccountingOutbox_status_nextAttemptAt_idx" ON "AccountingOutbox"("status", "nextAttemptAt");
+
+-- CreateIndex
+CREATE INDEX "AccountingOutbox_kind_entityId_idx" ON "AccountingOutbox"("kind", "entityId");
+
+-- CreateIndex
+CREATE INDEX "AccountingIssue_resolvedAt_idx" ON "AccountingIssue"("resolvedAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AccountingIssue_provider_kind_externalCode_key" ON "AccountingIssue"("provider", "kind", "externalCode");
+
+
+-- The new admin screen's permission. The seeded super-admin user type (85,
+-- prisma/seed.ts) gets every rid in ALL_RIDS on a fresh seed; an existing
+-- database has to be granted the new one here.
+INSERT INTO "permission" ("rid", "userTypeId")
+SELECT 'config.accounting', 85
+WHERE EXISTS (SELECT 1 FROM "user_type" WHERE "id" = 85)
+ON CONFLICT DO NOTHING;