Brand OTP SMS with business name and support local SMS proxy.

Append tenant Farsi name to verification SMS, allow optional domain on send-otp, and add SMS_PROXY_* for local delivery via production. Also include websites SSL sync agent/API wiring.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/websites-agent/ssl.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Issue / renew Let's Encrypt cert for a storefront apex (+ www) via nginx plugin.
+set -euo pipefail
+
+HOST="${1:-}"
+
+if [[ -z "$HOST" ]]; then
+  echo "usage: ssl.sh <host>" >&2
+  exit 1
+fi
+
+if [[ ! "$HOST" =~ ^[a-z0-9.-]+$ ]]; then
+  echo "invalid host: $HOST" >&2
+  exit 1
+fi
+
+NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
+NGINX_ENABLED="/etc/nginx/sites-enabled/$HOST"
+LOG_DIR="/var/log/websites"
+mkdir -p "$LOG_DIR"
+LOG="$LOG_DIR/ssl-$HOST.log"
+exec >>"$LOG" 2>&1
+
+echo "==== $(date -u +%Y-%m-%dT%H:%M:%SZ) ssl start: $HOST ===="
+
+if [[ ! -f "$NGINX_AVAILABLE" && ! -f "$NGINX_ENABLED" ]]; then
+  echo "missing nginx site for $HOST (run provision first)"
+  exit 1
+fi
+
+if ! command -v certbot >/dev/null 2>&1; then
+  echo "certbot not installed"
+  exit 1
+fi
+
+certbot --nginx -d "$HOST" -d "www.$HOST" \
+  --non-interactive --agree-tos --register-unsafely-without-email --redirect
+
+echo "==== $(date -u +%Y-%m-%dT%H:%M:%SZ) ssl ok: $HOST ===="