Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/modules/sms/drivers/relay.driver.ts

@@ -46,6 +46,7 @@ export function relayConfig() {
     secret: envOr('SMS_RELAY_SECRET', DEFAULT_RELAY_SECRET),
     host: envOrNull('SMS_RELAY_HOST') ?? serverIpv4(),
     // "default" sends null, so the gateway chooses the line itself.
+    platform: platform.toLowerCase() === 'default' ? null : platform,
   };
 }
 
@@ -96,7 +97,7 @@ export const relayDriver: SmsDriver = {
     const reply = await postWithTimeout(
       c.url,
       { 'Content-Type': 'application/json', secret_key: c.secret },
-      JSON.stringify({ phone: mobile, host: c.host, text }),
+      JSON.stringify({ phone: mobile, host: c.host, text, platform: c.platform }),
       REQUEST_TIMEOUT_MS,
     );