fix(sms): unwrap MizbanSMS array-wrapped response to detect failures

The API returns its result inside a JSON array (e.g. "[1008]" for an
error, "[100002656565]" for a delivered message id). The previous parser
matched the raw string against the error map, so any array-wrapped error
slipped through as a false success and the caller got 201 with no SMS
sent. Unwrap the array (or bare/quoted value) before the error lookup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/notifications/sms.service.ts

@@ -138,13 +138,15 @@ export class SmsService {
     const message = this.mizbanMessage(kind, code);
     const to = toLocalMobile(phoneE164); // 09XXXXXXXXX
 
+    // Field shapes per the API's validation: To is a string[] (many recipients)
+    // while Message is a single string shared by all of them.
     const payload = {
       Usertype: this.config.get<number>('sms.mizban.userType') ?? 2,
       Username: this.config.get<string>('sms.mizban.username'),
       Password: this.config.get<string>('sms.mizban.password'),
       From: this.config.get<string>('sms.mizban.from'),
       To: [to],
-      Message: [message],
+      Message: message,
       Api: this.config.get<number>('sms.mizban.api'),
     };
 
@@ -156,8 +158,18 @@ export class SmsService {
       });
       const raw = (await res.text()).trim();
 
+      // The API wraps its result in a JSON array, e.g. "[1008]" for an error or
+      // "[100002656565]" for a delivered message id. Unwrap to the bare code.
+      let codeStr = raw;
+      try {
+        const parsed = JSON.parse(raw);
+        codeStr = String(Array.isArray(parsed) ? parsed[0] : parsed);
+      } catch {
+        codeStr = raw.replace(/[[\]"\s]/g, '');
+      }
+
       // Success returns a long numeric message id; failures are codes 1001–1011.
-      const reason = SmsService.MIZBAN_ERRORS[raw.replace(/^"|"$/g, '')];
+      const reason = SmsService.MIZBAN_ERRORS[codeStr];
       if (!res.ok || reason) {
         this.logger.error(
           `MizbanSMS OTP send failed (${res.status}): ${reason ?? raw}`,