fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

- production refuses to boot without JWT_SECRET instead of signing
  admin tokens with the published development key
- CORS_ORIGINS restricts browser callers; blank keeps allow-all with a
  production warning so a running deployment is not cut off
- the boot-time seed creates only roles and permissions in production;
  the demo customers, orders, debt and known-password accounts need
  SEED_DEMO_DATA=true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/prisma/seed.ts

@@ -28,32 +28,12 @@ const DEV_TEST_PHONE_PASSWORD_HASH = bcrypt.hashSync(DEV_TEST_PHONE, 10);
 // Replace these rows with real photo URLs when product photography exists.
 const PLACEHOLDER_PRODUCT_IMAGE = '/img/no-items.png';
 
-async function main() {
-  // ── Cities ────────────────────────────────────────────────────────────
-  const [tehran, mashhad, isfahan, tabriz] = await Promise.all([
-    prisma.city.upsert({ where: { id: 'city-tehran' }, update: {}, create: { id: 'city-tehran', name: 'تهران', province: 'تهران' } }),
-    prisma.city.upsert({ where: { id: 'city-mashhad' }, update: {}, create: { id: 'city-mashhad', name: 'مشهد', province: 'خراسان رضوی' } }),
-    prisma.city.upsert({ where: { id: 'city-isfahan' }, update: {}, create: { id: 'city-isfahan', name: 'اصفهان', province: 'اصفهان' } }),
-    prisma.city.upsert({ where: { id: 'city-tabriz' }, update: {}, create: { id: 'city-tabriz', name: 'تبریز', province: 'آذربایجان شرقی' } }),
-  ]);
-
-  // ── Branches & workshop ──────────────────────────────────────────────
-  const branchTehran = await prisma.branch.upsert({
-    where: { id: 'branch-tehran-bazaar' },
-    update: {},
-    create: { id: 'branch-tehran-bazaar', name: 'شعبه بازار بزرگ تهران', cityId: tehran.id },
-  });
-  const branchMashhad = await prisma.branch.upsert({
-    where: { id: 'branch-mashhad-main' },
-    update: {},
-    create: { id: 'branch-mashhad-main', name: 'شعبه مرکزی مشهد', cityId: mashhad.id },
-  });
-  await prisma.workshop.upsert({
-    where: { id: 'workshop-central' },
-    update: {},
-    create: { id: 'workshop-central', name: 'کارگاه مرکزی ساخت طلا' },
-  });
-
+/**
+ * Role definitions and their permissions — the one part of this file a real
+ * deployment needs (the admin screens and the legacy import map onto these
+ * ids). Idempotent: upserts and skipDuplicates only.
+ */
+async function seedAccessControl() {
   // ── Admin user types + permissions (legacy `permission(rid, ut)`) ────
   //
   // In legacy these lived in the dynamic `config_static` lookup under the key
@@ -108,6 +88,54 @@ async function main() {
       skipDuplicates: true,
     });
   }
+}
+
+/**
+ * Everything below is DEMO data: sample cities, branches, accounts with known
+ * passwords (one super admin whose password is its own phone number), sample
+ * customers, products, orders and posted debt. The app runs this seed once on
+ * a fresh database at boot (src/prisma/bootstrap.ts), so without this gate a
+ * production first boot would mix fake customers, fake debt and open admin
+ * accounts into the real data (SEC-05). Production never gets it unless
+ * SEED_DEMO_DATA=true is set on purpose.
+ */
+function demoDataAllowed(): boolean {
+  if (process.env.SEED_DEMO_DATA?.trim() === 'true') return true;
+  return process.env.NODE_ENV !== 'production';
+}
+
+async function main() {
+  await seedAccessControl();
+
+  if (!demoDataAllowed()) {
+    console.log('seed: production — roles and permissions only; demo data skipped (set SEED_DEMO_DATA=true to force)');
+    return;
+  }
+
+  // ── Cities ────────────────────────────────────────────────────────────
+  const [tehran, mashhad, isfahan, tabriz] = await Promise.all([
+    prisma.city.upsert({ where: { id: 'city-tehran' }, update: {}, create: { id: 'city-tehran', name: 'تهران', province: 'تهران' } }),
+    prisma.city.upsert({ where: { id: 'city-mashhad' }, update: {}, create: { id: 'city-mashhad', name: 'مشهد', province: 'خراسان رضوی' } }),
+    prisma.city.upsert({ where: { id: 'city-isfahan' }, update: {}, create: { id: 'city-isfahan', name: 'اصفهان', province: 'اصفهان' } }),
+    prisma.city.upsert({ where: { id: 'city-tabriz' }, update: {}, create: { id: 'city-tabriz', name: 'تبریز', province: 'آذربایجان شرقی' } }),
+  ]);
+
+  // ── Branches & workshop ──────────────────────────────────────────────
+  const branchTehran = await prisma.branch.upsert({
+    where: { id: 'branch-tehran-bazaar' },
+    update: {},
+    create: { id: 'branch-tehran-bazaar', name: 'شعبه بازار بزرگ تهران', cityId: tehran.id },
+  });
+  const branchMashhad = await prisma.branch.upsert({
+    where: { id: 'branch-mashhad-main' },
+    update: {},
+    create: { id: 'branch-mashhad-main', name: 'شعبه مرکزی مشهد', cityId: mashhad.id },
+  });
+  await prisma.workshop.upsert({
+    where: { id: 'workshop-central' },
+    update: {},
+    create: { id: 'workshop-central', name: 'کارگاه مرکزی ساخت طلا' },
+  });
 
   // ── Admin users (sales agents + one super admin) ────────────────────