Add passwordless OTP login and SMS password reset.

Expose login-otp and reset-password so dashboards can finish forgot-password and one-time SMS sign-in, and sync website API docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/AI_PROMPT.md

@@ -32,7 +32,7 @@ You are building a **Meshkee business website (storefront)**. You must use the M
 1. `GET /tenants/{domain}` → branding + `businessId`
 2. Homepage: business-info, sliders, category-groups, brand-groups, store-specials
 3. Catalog: categories, products, store-items
-4. Auth: register/login → store tokens
+4. Auth: register/login → store tokens. Optional: `POST /auth/send-otp` then `POST /auth/login-otp` (passwordless) or `POST /auth/reset-password` (forgot password). `POST /auth/verify-otp` only marks the cell verified (no tokens).
 5. Cart checkout with `addressId` or inline `shippingAddress` + `payment`
 
 If OpenAPI and this brief conflict, **OpenAPI wins**.

docs/website-api/Meshkee-Website-API.postman_collection.json

@@ -200,6 +200,55 @@
             "url": "{{baseUrl}}/auth/login"
           }
         },
+        {
+          "name": "Login with OTP",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "exec": [
+                  "if (pm.response.code === 200) {",
+                  "  const json = pm.response.json();",
+                  "  pm.collectionVariables.set('accessToken', json.accessToken);",
+                  "  pm.collectionVariables.set('refreshToken', json.refreshToken);",
+                  "}"
+                ],
+                "type": "text/javascript"
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"cellNumber\": \"+98XXXXXXXXXX\",\n  \"code\": \"123456\"\n}"
+            },
+            "url": "{{baseUrl}}/auth/login-otp"
+          }
+        },
+        {
+          "name": "Reset password (SMS OTP)",
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"cellNumber\": \"+98XXXXXXXXXX\",\n  \"code\": \"123456\",\n  \"newPassword\": \"newpassword123\"\n}"
+            },
+            "url": "{{baseUrl}}/auth/reset-password"
+          }
+        },
         {
           "name": "Me (current user)",
           "request": {

docs/website-api/openapi.json

@@ -527,6 +527,51 @@
         "responses": { "200": { "description": "{ user, accessToken, refreshToken }" } }
       }
     },
+    "/auth/login-otp": {
+      "post": {
+        "tags": ["Auth"],
+        "summary": "Passwordless login with SMS OTP",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": ["cellNumber", "code"],
+                "properties": {
+                  "cellNumber": { "type": "string" },
+                  "code": { "type": "string", "minLength": 6, "maxLength": 6 }
+                }
+              }
+            }
+          }
+        },
+        "responses": { "200": { "description": "{ user, accessToken, refreshToken }" } }
+      }
+    },
+    "/auth/reset-password": {
+      "post": {
+        "tags": ["Auth"],
+        "summary": "Reset password with SMS OTP",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": ["cellNumber", "code", "newPassword"],
+                "properties": {
+                  "cellNumber": { "type": "string" },
+                  "code": { "type": "string", "minLength": 6, "maxLength": 6 },
+                  "newPassword": { "type": "string", "minLength": 8 }
+                }
+              }
+            }
+          }
+        },
+        "responses": { "200": { "description": "{ message }" } }
+      }
+    },
     "/auth/refresh": {
       "post": {
         "tags": ["Auth"],