fix(sms): every SMS says منتزر instead of هنزا گلد

The SMS texts were ported verbatim from henza and still carried its brand:
the login code, the welcome message (with the app.henzagold.com link), the
two complete-profile messages and the financial-document confirm/reject.
All now say منتزر, and the welcome link is https://bnk.montzar.ir.

The login code keeps its first line ("<#> code is <CODE>") and the trailing
SMS Retriever hash unchanged, so Android autofill still works. «اپلیکشن» is
corrected to «اپلیکیشن» in the same line.

Tests: sms.service.spec OTP template. All 263 API tests pass.
Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/modules/customer-auth/customer-auth.service.ts

@@ -728,13 +728,13 @@ export class CustomerAuthService {
    * simply retries, and the throttle in assertSendAllowed still applies.
    */
   private async deliver(mobile: string, code: string) {
-    // BYTE-IDENTICAL to the reference (ApiMobileController.php:47). The
-    // leading "<#> code is <CODE>" line and the trailing "aMo6iFyUQaY" are the
-    // Android SMS Retriever app hash — change either and autofill stops
-    // working on every installed client. Do not "tidy" this string.
+    // The reference's text (ApiMobileController.php:47) with the brand changed
+    // to منتزر. The leading "<#> code is <CODE>" line and the trailing
+    // "aMo6iFyUQaY" are the Android SMS Retriever app hash — change either and
+    // autofill stops working on every installed client. Do not "tidy" them.
     const smsText =
       `<#> code is ${code}\n` +
-      `رمز عبور یکبار مصرف شما جهت ورود به اپلیکشن هنزا گلد ${code} می باشد\n` +
+      `رمز عبور یکبار مصرف شما جهت ورود به اپلیکیشن منتزر ${code} می باشد\n` +
       `aMo6iFyUQaY`;
 
     // persist:false — the real text carries the live code, and the admin SMS