Brand OTP SMS with business name and support local SMS proxy.

Append tenant Farsi name to verification SMS, allow optional domain on send-otp, and add SMS_PROXY_* for local delivery via production. Also include websites SSL sync agent/API wiring.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/websites-agent/server.js

@@ -176,6 +176,42 @@ const server = http.createServer(async (req, res) => {
     }
   }
 
+  if (req.method === 'POST' && req.url === '/ssl') {
+    if (!assertAuth(req, res)) return;
+
+    let body;
+    try {
+      body = await readJson(req);
+    } catch {
+      return send(res, 400, { error: 'invalid json' });
+    }
+
+    const host = String(body.host || '').trim().toLowerCase();
+    const slug = String(body.slug || '').trim();
+
+    if (!host || !/^[a-z0-9.-]+$/.test(host)) {
+      return send(res, 400, { error: 'valid host is required' });
+    }
+
+    if (slug && !allowedSlugs().has(slug)) {
+      return send(res, 400, { error: 'unknown or disallowed slug' });
+    }
+
+    try {
+      const result = await runScript('/opt/websites-agent/ssl.sh', [host]);
+      return send(res, 200, {
+        status: 'issued',
+        host,
+        log: (result.stdout || '').slice(-2000),
+      });
+    } catch (err) {
+      return send(res, 500, {
+        error: 'ssl issue failed',
+        detail: err instanceof Error ? err.message.slice(0, 2000) : String(err),
+      });
+    }
+  }
+
   return send(res, 404, { error: 'not found' });
 });