parity(api,apps): delivery-mode gaps — master OTP, non-blocking SMS, faToEn, v2 cart cap

D20: OTP_MASTER_CODE login bypass read only from the environment, disabled when
unset, audited on every use, with a boot banner while armed. SMS no longer
aborts the boot in production — it warns and declines silently, so no message
can stop an operation.

D19: port Utility::faTOen onto admin-entered mobiles (before the uniqueness
lookup, which could previously be bypassed with Persian digits), and the
create-only welcome SMS, byte-identical to the reference and fire-and-forget.

user-app-v2 was missing the cart stock ceiling entirely: capQty/maxQty, the
un-orderable guard and the qty clamp are ported, leaving v2's own design intact.
The two cart stores are now byte-identical. isVariantOrderable and the
orderable-first default selection ported too.

jest 45/45; typecheck clean on api, admin-panel, user-app, user-app-v2.

[ref: henza_server/app/Http/Controllers/Adm/AdminController.php:333,348,364,378-387]
[ref: henza_server/app/Models/Utility.php:26]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -8,6 +8,7 @@ import { AppModule } from './app.module';
 import { prepareDatabase } from './prisma/bootstrap';
 import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
 import { assertSmsConfigured } from './modules/sms/sms.service';
+import { masterOtpEnabled } from './modules/customer-auth/customer-auth.service';
 
 // serve-static's bundled `mime` version predates .avif, so it falls back to
 // application/octet-stream — browsers still render the image (they sniff
@@ -17,11 +18,25 @@ const EXTRA_MIME_TYPES: Record<string, string> = {
 };
 
 async function bootstrap() {
-  // Fail fast rather than start a server on which no customer could log in.
-  // In production a missing SMS credential throws here; outside production it
-  // only warns and the codes are logged locally.
+  // D20 — reports the SMS configuration and never throws. A missing credential
+  // no longer stops the boot; messages are logged instead of sent.
   assertSmsConfigured();
 
+  // D20 — a loud, unmissable banner whenever the delivery bypass is armed, so
+  // it cannot reach the real release unnoticed.
+  if (masterOtpEnabled()) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      '\n' +
+        '='.repeat(72) +
+        '\n  ⚠  OTP_MASTER_CODE فعال است — قبل از انتشار اصلی حذف شود\n' +
+        '  ⚠  OTP_MASTER_CODE IS ACTIVE: any active customer can sign in with\n' +
+        '  ⚠  this fixed code. Remove it from the environment before release.\n' +
+        '='.repeat(72) +
+        '\n',
+    );
+  }
+
   await prepareDatabase();
 
   const app = await NestFactory.create<NestExpressApplication>(AppModule);