remove user-secrets approach & prepare a pilot deploy

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/SeamOptions.cs

@@ -2,7 +2,7 @@ namespace Baya.Infrastructure.CrossCutting.Seams;
 
 /// <summary>
 /// Options bound from the <c>Seams</c> configuration section. The mock seams read non-secret defaults
-/// from here; production keys/paths come from environment variables or user-secrets, never committed.
+/// from here; deployed keys/paths come from the environment-specific appsettings file or environment variables.
 ///
 /// <para><b>Provider selection (refinement-phase-8).</b> Each vendor rail carries a <c>Provider</c> selector
 /// (default = the mock, so an unconfigured environment behaves exactly as before). Setting it to a real
@@ -37,7 +37,7 @@ public sealed class SeamOptions
 /// (<c>IShahkarVerifier</c>), e-KYC (<c>IIdentityKycProvider</c>), and استعلام شبا
 /// (<c>IBankAccountOwnershipVerifier</c>). Each seam opts in with its own <c>Provider = finnotech</c> selector,
 /// but they authenticate against the same tenant, so the connection facts live here once. All values are
-/// secrets — user-secrets / environment, never committed.
+/// secrets — the environment-specific appsettings file or environment variables.
 /// </summary>
 public sealed class FinnotechOptions
 {
@@ -63,8 +63,9 @@ public static class SeamProviders
     public const string SmsIr = "smsir";
     public const string Ghasedak = "ghasedak";
 
-    /// <summary><b>Development convenience channel, not an SMS gateway</b> — the local <c>telegram-otp-bot/</c>
-    /// relay broadcasts every code to a fixed list of Telegram chat ids. Never select it in a real environment.</summary>
+    /// <summary><b>Broadcast relay, not an SMS gateway</b> — the standalone <c>telegram-otp-bot/</c> service
+    /// sends every code to a fixed list of Telegram chat ids. The pre-launch demo rail; replace with a real
+    /// gateway before onboarding customers outside the trusted group.</summary>
     public const string Telegram = "telegram";
 
     // Object storage
@@ -105,7 +106,7 @@ public sealed class SmsOptions
     /// (Development only).</summary>
     public string Provider { get; set; } = SeamProviders.Mock;
 
-    /// <summary>Gateway API key / token (secret — user-secrets or environment, never committed).</summary>
+    /// <summary>Gateway API key / token (secret — the environment-specific appsettings file or environment variables).</summary>
     public string ApiKey { get; set; } = string.Empty;
 
     /// <summary>The registered sender line (used by <c>SendAsync</c> free-form messages and non-template sends).</summary>
@@ -122,13 +123,15 @@ public sealed class SmsOptions
 }
 
 /// <summary>
-/// The <b>Development-only</b> Telegram OTP relay (the standalone <c>telegram-otp-bot/</c> Node service),
-/// selected by <c>Seams:Sms:Provider = telegram</c>. It replaces "read the OTP out of the server log" during
-/// manual testing — the tester gets the code on their phone without paying an Iranian SMS gateway.
+/// The Telegram OTP relay (the standalone <c>telegram-otp-bot/</c> Node service), selected by
+/// <c>Seams:Sms:Provider = telegram</c>. It replaces "read the OTP out of the server log" — the tester gets the
+/// code on their phone without an Iranian SMS gateway contract.
 ///
 /// <para><b>It is not an SMS gateway.</b> There is no per-user routing: the relay <i>broadcasts</i> every code
-/// to a fixed list of Telegram chat ids, so every configured recipient reads every login code. That is fine for
-/// a test group and disqualifying for anything else — never point a deployed environment at it.</para>
+/// to a fixed list of Telegram chat ids, so every configured recipient reads every login code. That is workable
+/// for a trusted demo group — which is why the pre-launch <c>balinyaar.ir</c> deployment uses it — and
+/// disqualifying once anyone outside that group can request a code. Switch <c>Seams:Sms:Provider</c> to
+/// <c>kavenegar</c> at that point; nothing else changes.</para>
 /// </summary>
 public sealed class TelegramOptions
 {
@@ -137,7 +140,7 @@ public sealed class TelegramOptions
 
     /// <summary>The shared secret sent as the relay's <c>X-Api-Key</c> header — it must equal the relay's
     /// <c>API_KEY</c>. <b>Secret:</b> committed config carries an empty/placeholder value; the real one comes
-    /// from user-secrets (<c>Seams:Sms:Telegram:ApiKey</c>) or the environment, never git.</summary>
+    /// from <c>Seams:Sms:Telegram:ApiKey</c> in appsettings or the environment.</summary>
     public string ApiKey { get; set; } = string.Empty;
 
     /// <summary>Per-request timeout. The relay itself talks to Telegram (over a proxy in a filtered region), so