fix(sms): fail loudly when credentials missing, propagate SMS error to OTP response

backend/src/auth/auth.service.ts

@@ -43,7 +43,16 @@ export class AuthService {
     await this.redisService.set(`otp:${phoneNumber}`, code, 120);
 
     // Dispatch OTP via MeliPayamak Pattern SMS
-    await this.smsService.sendOtp(phoneNumber, code);
+    const smsSent = await this.smsService.sendOtp(phoneNumber, code);
+
+    if (!smsSent) {
+      // Remove OTP from Redis if SMS failed to avoid phantom codes
+      await this.redisService.del(`otp:${phoneNumber}`);
+      throw new BadRequestException({
+        message: 'ارسال پیامک با خطا مواجه شد. لطفاً چند لحظه دیگر دوباره تلاش کنید.',
+        error: 'SMS_DELIVERY_FAILED',
+      });
+    }
 
     return {
       success: true,

backend/src/common/services/sms.service.ts

@@ -23,10 +23,12 @@ export class SmsService {
    */
   async sendPatternSms(options: SendPatternSmsOptions): Promise<boolean> {
     if (!this.username || !this.password) {
-      this.logger.warn(
-        `[SMS Simulated] MeliPayamak dispatch to ${options.to} (Pattern: ${options.bodyId}, Args: ${options.args.join(', ')})`,
+      this.logger.error(
+        `[SMS MISCONFIGURED] MELIPAYAMAK_PASSWORD is not set! ` +
+        `SMS to ${options.to} (Pattern: ${options.bodyId}) was NOT sent. ` +
+        `Set MELIPAYAMAK_USERNAME and MELIPAYAMAK_PASSWORD environment variables.`,
       );
-      return true;
+      return false;
     }
 
     return new Promise((resolve) => {