Add shipping cost groups and reject spam contact-form SMS.

Wire cart/checkout shipping fees with category groups and static rates, reject gibberish contact submissions, and SMS only valid Iranian mobiles.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/sms.service.ts

@@ -501,6 +501,18 @@ export function toGamaMsisdn(raw: string): string | null {
   return msisdn;
 }
 
+/**
+ * Iranian mobile only (local 09xxxxxxxxx → `989xxxxxxxxx`).
+ * Rejects landlines, foreign numbers, and invalid formats.
+ */
+export function toIranianMobileMsisdn(raw: string): string | null {
+  const msisdn = toGamaMsisdn(raw);
+  if (!msisdn || !/^989\d{9}$/.test(msisdn)) {
+    return null;
+  }
+  return msisdn;
+}
+
 export function maskMsisdn(msisdn: string): string {
   if (msisdn.length < 6) return '***';
   return `${msisdn.slice(0, 4)}****${msisdn.slice(-3)}`;