Merge release/delivery (IAM single sign-on) into the triage work

Brings the four release/delivery commits (IAM SSO for the admin panel,
both apps and the API; IAM env in docker-compose) onto fix/issues-triage.

Conflicts:
- customer-auth.service.ts imports: both kept.
- both apps' api/client.ts: both kept (AccountingBalance/WageQuote, and
  iamAppUrl).
- all build output (admin-panel, user-app, user-app-v2 dist, and the api
  release bundle): rebuilt from the merged source instead of picking a
  side.

Fixed while verifying:
- The IAM change calls iam.browserBootstrapUrl after every login, but
  the identity-service stand-ins in three test files lacked it. 15 tests
  failed on release/delivery itself.
- SMS relay: SMS_RELAY_PLATFORM was read but never sent, so the gateway
  never got `platform` (documented body: phone, host, text, platform).
  relayConfig() now returns it ("default" → null) and the request carries
  it. sms.service.spec now passes.

All 249 API tests pass; the three front-ends type-check and build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/user-app/src/api/client.ts

@@ -312,6 +312,12 @@ export interface WageQuote {
   finalPercent: string
 }
 
+function iamAppUrl(path: string) {
+  const base = import.meta.env.BASE_URL || '/'
+  const prefix = base.endsWith('/') ? base : `${base}/`
+  return `${window.location.origin}${prefix}${path.replace(/^\//, '')}`
+}
+
 export const api = {
   listProducts: () => request<ProductSummary[]>('/catalog/products'),
 
@@ -332,11 +338,27 @@ export const api = {
    * already-used code is a 401.
    */
   verifyOtp: (username: string, password: string) =>
-    request<{ token: string; customer: { id: string; mobile: string } }>(
+    request<{ token: string; customer: { id: string; mobile: string }; iamBootstrapUrl?: string }>(
       '/customer/auth/verify-otp',
       { method: 'POST', body: JSON.stringify({ username, password }) },
     ),
 
+  ssoStart: () =>
+    request<{ enabled: boolean; authorize_url: string | null }>(
+      `/customer/auth/sso/start?redirect_uri=${encodeURIComponent(iamAppUrl('auth/iam/callback'))}`,
+    ),
+
+  ssoCallback: (code: string, state: string) =>
+    request<{ token: string; customer: { id: string; mobile: string } }>('/customer/auth/sso/callback', {
+      method: 'POST',
+      body: JSON.stringify({ code, state }),
+    }),
+
+  ssoLogoutUrl: () =>
+    request<{ logout_url: string | null }>(
+      `/customer/auth/sso/logout-url?return_url=${encodeURIComponent(iamAppUrl(''))}`,
+    ),
+
   // The three reads below identify the customer by TOKEN. They replaced
   // /customers/:id, /:id/orders and /:id/ledger-entries, which took the id from
   // the URL and let anyone read anyone (SEC-08).

apps/user-app/src/router/index.ts

@@ -32,6 +32,7 @@ export const router = createRouter({
     { path: '/newest', name: 'newestProduct', component: () => import('../views/NewestView.vue'), meta: { layout: 'FullPage' } },
     { path: '/cart', name: 'cart', component: () => import('../views/CartView.vue') },
     { path: '/login', name: 'login', component: () => import('../views/user/LoginRegisterView.vue'), meta: { layout: 'FullPage' } },
+    { path: '/auth/iam/callback', name: 'iamCallback', component: () => import('../views/user/IamCallback.vue'), meta: { layout: 'FullPage' } },
     { path: '/user', name: 'userPage::hasSubRoute', component: () => import('../views/user/DashboardView.vue') },
     { path: '/orders', name: 'ordersList', component: () => import('../views/user/OrdersView.vue'), meta: { requiresAuth: true } },
     {
@@ -101,6 +102,19 @@ router.beforeEach(async (to) => {
   const session = useSessionStore();
   const nav = useNavStore();
 
+  if (!session.isLoggedIn && to.name !== 'iamCallback' && sessionStorage.getItem('gb_iam_sso_checked') !== '1') {
+    sessionStorage.setItem('gb_iam_sso_checked', '1');
+    try {
+      const started = await api.ssoStart();
+      if (started.enabled && started.authorize_url) {
+        window.location.assign(started.authorize_url);
+        return false;
+      }
+    } catch {
+      // سامانه هویت خاموش است یا در دسترس نیست
+    }
+  }
+
   if (to.name === 'login' && session.isLoggedIn) {
     return { name: 'home' };
   }

apps/user-app/src/views/user/DashboardView.vue

@@ -237,9 +237,20 @@ function goToDetails(id: number) {
   if (id === 6) router.push({ name: 'report' })
 }
 
-function logOut() {
-  session.logout()
+async function logOut() {
   data.notify = false
+  let central: string | null = null
+  try {
+    central = (await api.ssoLogoutUrl()).logout_url
+  } catch {
+    central = null
+  }
+  session.logout()
+  sessionStorage.removeItem('gb_iam_sso_checked')
+  if (central) {
+    window.location.assign(central)
+    return
+  }
   router.push({ name: 'home' })
 }
 

apps/user-app/src/views/user/IamCallback.vue

@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { onMounted } from 'vue'
+import { useRouter } from 'vue-router'
+import { api } from '../../api/client'
+import { useSessionStore } from '../../stores/session'
+
+const router = useRouter()
+const session = useSessionStore()
+
+onMounted(async () => {
+  const params = new URLSearchParams(window.location.search)
+  sessionStorage.setItem('gb_iam_sso_checked', '1')
+
+  if (params.get('error') || !params.get('code') || !params.get('state')) {
+    await router.replace({ name: 'login' })
+    return
+  }
+
+  try {
+    const result = await api.ssoCallback(params.get('code') as string, params.get('state') as string)
+    session.login(result.token, result.customer.id, result.customer.mobile)
+    try {
+      const who = await api.getExpertIdentity()
+      session.setSalesExpert(who.isSalesExpert)
+    } catch {
+      session.setSalesExpert(false)
+    }
+    await router.replace({ name: 'home' })
+  } catch {
+    await router.replace({ name: 'login' })
+  }
+})
+</script>
+
+<template>
+  <div style="min-height: 100vh; display: grid; place-items: center">در حال ورود...</div>
+</template>

apps/user-app/src/views/user/LoginView.vue

@@ -159,7 +159,8 @@ const sendPhone = async () => {
 const sendToken = async (otpCode: string) => {
   try {
     body.loading = true
-    const { token, customer } = await api.verifyOtp(String(formModel.username ?? ''), otpCode)
+    const verified = await api.verifyOtp(String(formModel.username ?? ''), otpCode)
+    const { token, customer } = verified
     session.login(token, customer.id, customer.mobile)
     // D21 — ask the server which kind of principal this token is, so the
     // expert-only entries appear for a sales expert. Failure is non-fatal:
@@ -171,6 +172,10 @@ const sendToken = async (otpCode: string) => {
     } catch {
       session.setSalesExpert(false)
     }
+    if (verified.iamBootstrapUrl) {
+      window.location.assign(verified.iamBootstrapUrl)
+      return
+    }
     const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : undefined
     await router.push(redirect ?? { name: 'home' })
     toast.success('با موفقیت وارد شدید')