parity(api,apps): delivery-mode gaps — master OTP, non-blocking SMS, faToEn, v2 cart cap

D20: OTP_MASTER_CODE login bypass read only from the environment, disabled when
unset, audited on every use, with a boot banner while armed. SMS no longer
aborts the boot in production — it warns and declines silently, so no message
can stop an operation.

D19: port Utility::faTOen onto admin-entered mobiles (before the uniqueness
lookup, which could previously be bypassed with Persian digits), and the
create-only welcome SMS, byte-identical to the reference and fire-and-forget.

user-app-v2 was missing the cart stock ceiling entirely: capQty/maxQty, the
un-orderable guard and the qty clamp are ported, leaving v2's own design intact.
The two cart stores are now byte-identical. isVariantOrderable and the
orderable-first default selection ported too.

jest 45/45; typecheck clean on api, admin-panel, user-app, user-app-v2.

[ref: henza_server/app/Http/Controllers/Adm/AdminController.php:333,348,364,378-387]
[ref: henza_server/app/Models/Utility.php:26]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app-v2/src/stores/cartStore.ts

@@ -54,13 +54,42 @@ export const useCartStore = defineStore('cart', {
       }
     },
     addToCart(data: CartItem) {
+      // Refuse a variant that cannot be ordered — out of stock and not flagged
+      // pre-order. The same guard the admin cart applies (stores/cart.ts), kept
+      // here so it holds even if a caller forgets to disable its button.
+      const target = data.product?.variants?.find((v) => v.id === data.vid)
+      if (!target) return false
+      if (!((target.qty ?? 0) > 0 || target.isPreOrder)) return false
+
       const index = this.find_index(data)
-      if (index === -1) this.items.push(data)
+      if (index === -1) this.items.push({ ...data, qty: this.capQty(data.qty, target) })
       else {
         this.items[index].product = data.product
-        this.items[index].qty = data.qty
+        this.items[index].qty = this.capQty(data.qty, target)
       }
       persist(this.items)
+      return true
+    },
+
+    /**
+     * Stock ceiling for a cart line. A pre-order variant is orderable beyond
+     * what is on hand (that is the point of pre-ordering), so it is uncapped;
+     * anything else stops at its on-hand quantity.
+     */
+    capQty(want: number, variant: { qty?: number; isPreOrder?: boolean }) {
+      const n = Math.max(1, Math.floor(want) || 1)
+      if (variant.isPreOrder) return n
+      const max = variant.qty ?? 0
+      return max > 0 ? Math.min(n, max) : n
+    },
+
+    /** The ceiling for an item already in the cart; null when uncapped. */
+    maxQty(item: Pick<CartItem, 'pid' | 'vid'>) {
+      const i = this.find_index(item)
+      if (i === -1) return null
+      const v = this.variant(this.items[i])
+      if (!v || v.isPreOrder) return null
+      return (v.qty ?? 0) > 0 ? (v.qty as number) : null
     },
     remove(item: CartItem) {
       const index = this.find_index(item)
@@ -72,6 +101,13 @@ export const useCartStore = defineStore('cart', {
     updateFeild(value: unknown, index: number | null, item: Pick<CartItem, 'pid' | 'vid'>, field: keyof CartItem) {
       if (!this.isInCart(item)) return false
       const i = index ?? this.find_index(item)
+      // A quantity change is clamped to what is actually in stock (unless the
+      // variant is pre-orderable), so the ceiling holds no matter which screen
+      // drives the stepper.
+      if (field === 'qty') {
+        const v = this.variant(this.items[i])
+        value = v ? this.capQty(Number(value), v) : Math.max(1, Number(value) || 1)
+      }
       ;(this.items[i] as any)[field] = value
       persist(this.items)
       return true