Merge branch 'docs/env-example-sms'

backend/.env.example

@@ -20,12 +20,30 @@ JWT_REFRESH_EXPIRES_IN=7d
 REDIS_HOST=localhost
 REDIS_PORT=6379
 
-# OTP SMS — Kavenegar (verify/lookup template API)
-# Create an approved OTP template in the Kavenegar panel and put its name here.
-# The template must contain a single %token placeholder for the code.
+# ─── OTP SMS ────────────────────────────────────────────────────────────────
+# Pick the provider. Without valid credentials, OTP codes are logged to the API
+# console in development only; in production a missing config makes OTP send fail
+# (registration + passwordless login return 503).
+SMS_PROVIDER=mizbansms          # "mizbansms" (default) | "kavenegar"
+
+# MizbanSMS (services.mizbansms.com) — sends the full OTP text over a dedicated
+# line. USERNAME/PASSWORD are required; FROM/API/USERTYPE come from your panel.
+# `Api` is the *active route* number for the FROM line (ask support if 1008).
+MIZBANSMS_USERNAME=
+MIZBANSMS_PASSWORD=
+MIZBANSMS_FROM=5000467254
+MIZBANSMS_API=2016
+MIZBANSMS_USERTYPE=2            # 2 = customer account, 1 = reseller
+# Per-flow message text; `{code}` (or `{{CODE}}`) is replaced with the 6-digit OTP.
+# Defaults are sensible Persian wording — override only to customise.
+# MIZBANSMS_OTP_TEMPLATE_REGISTER=به ابربان خوش آمدید.\nکد تأیید شما: {code}
+# MIZBANSMS_OTP_TEMPLATE_LOGIN=رمز یکبار مصرف ابربان:\n{code}
+# MIZBANSMS_OTP_TEMPLATE_CHANGE_PHONE=کد تأیید شماره جدید ابربان:\n{code}
+
+# Kavenegar (verify/lookup template API) — only used when SMS_PROVIDER=kavenegar.
+# Create an approved OTP template in the panel; it must contain a %token placeholder.
 KAVENEGAR_API_KEY=
 KAVENEGAR_OTP_TEMPLATE=
-# Without these, OTP codes are logged to the API console in development only.
 
 # Seed admin mobile (login is mobile-only) — used by `npm run seed`.
 ADMIN_PHONE=09120000000
@@ -52,6 +70,9 @@ BUILD_NAMESPACE=cloudhost-builds
 BUILD_SERVICE_ACCOUNT=kaniko-builder
 
 # Platform
+# Public URL(s) of the frontend — used for CORS and to derive the platform/preview
+# domains. May be a comma-separated list of origins (first one drives domain resolution).
+FRONTEND_URL=http://localhost:3000
 PLATFORM_DOMAIN=apps.cloudhost.local
 # Base domain for per-user preview URLs (<userId>-<7-digit>.<base-domain>).
 # Falls back to the root domain derived from FRONTEND_URL when unset.