fix(trade): simplify proxy order and respect product whitelist

Drop SMS verification for HQ/partner proxy orders; keep form draft across product picker; hide whitelist-only products from partner catalog.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/ops/admin-proxy-orders.controller.ts

@@ -10,11 +10,7 @@ import type { AuthUser } from '../../common/guards/jwt-auth.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { TradeService } from '../trade/trade.service';
-import {
-  HqProxyOrderCreateDto,
-  HqProxyOrderPreviewDto,
-  HqProxyOrderSendCustomerSmsDto,
-} from './dto/hq-proxy-order.dto';
+import { HqProxyOrderCreateDto, HqProxyOrderPreviewDto } from './dto/hq-proxy-order.dto';
 
 @Controller('admin/proxy-orders')
 @UseGuards(HqAuthGuard, HqPermissionGuard)
@@ -29,17 +25,7 @@ export class AdminProxyOrdersController {
 
   @Post('preview')
   preview(@Body() dto: HqProxyOrderPreviewDto) {
-    return this.tradeService.previewPartnerProxyOrder(dto);
-  }
-
-  @Post('send-customer-sms')
-  sendCustomerSms(@Body() dto: HqProxyOrderSendCustomerSmsDto) {
-    return this.tradeService.sendHqProxyCustomerSms(dto.phone);
-  }
-
-  @Post('send-operator-sms')
-  sendOperatorSms(@CurrentUser() user: AuthUser) {
-    return this.tradeService.sendHqProxyOperatorSms(user.actorId);
+    return this.tradeService.previewPartnerProxyOrder(dto, { bypassWhitelist: true });
   }
 
   @Post()