harden OTP for real SMS and close the second audit round

Kavenegar is being switched on, so every OTP request now costs credit:
- phone numbers are normalised to 09XXXXXXXXX everywhere (login, OTP,
  family invite, TEST_LOGIN_PHONES keys) and existing rows are migrated;
  non-Iranian and landline numbers are rejected before any SMS
- cooldown and a daily per-phone cap are counted in the database, so the
  three gunicorn workers no longer triple them
- a global daily OTP SMS cap (default 300) stops SMS pumping
- per-IP rates widened for CGNAT / school Wi-Fi (env-overridable)
- provider message id is logged; SMS text warns not to share the code

Second audit round: an offer no longer shortens a longer paid plan,
Zarinpal error bodies no longer 500, island XP reaches the parent report,
a non-numeric questionId no longer 500s after the answer is generated.

596 tests green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

family/serializers.py

@@ -1,8 +1,10 @@
 from rest_framework import serializers
 
+from accounts.serializers import IranMobileField
+
 
 class FamilyLinkInviteRequestSerializer(serializers.Serializer):
-    childPhone = serializers.CharField(max_length=15)
+    childPhone = IranMobileField()
 
 
 class FamilyLinkInviteResponseSerializer(serializers.Serializer):
@@ -47,5 +49,8 @@ class FamilyWeeklyReportResponseSerializer(serializers.Serializer):
     weekStart = serializers.DateField()
     xpEarned = serializers.IntegerField()
     lessonsCompleted = serializers.IntegerField()
+    # افزوده ۲۰۲۶-۰۹-۲۵: جزیره‌هایی که آزمونشان در این هفته تمام شده. xpEarned
+    # از همین تاریخ امتیازِ آزمونِ جزیره را هم دارد.
+    islandsCompleted = serializers.IntegerField()
     currentStreak = serializers.IntegerField()
     openedAt = serializers.DateTimeField(allow_null=True)