tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

accounts/serializers.py

@@ -1,5 +1,19 @@
+import re
+
 from rest_framework import serializers
 
+# لینک، آیدیِ شبکه‌ی اجتماعی، و هر رشته‌ی ۵ رقمی یا بیشتر (شماره‌ی تلفن با
+# فاصله/خط‌تیره هم) — ارقامِ فارسی و عربی هم.
+_CONTACT = re.compile(
+    r'(https?://\S+|www\.\S+|\S+\.(?:com|ir|org|net|me)\S*|@\w+'
+    r'|(?:[0-9۰-۹٠-٩][\s\-.]?){5,})',
+    re.IGNORECASE,
+)
+
+
+def clean_display_name(value: str) -> str:
+    return ' '.join(_CONTACT.sub(' ', value or '').split())[:30]
+
 
 # ---- Request serializers ----
 
@@ -43,6 +57,14 @@ class UpdateProfileRequestSerializer(serializers.Serializer):
     """
     name = serializers.CharField(max_length=100, required=False, allow_blank=True)
     avatar = serializers.CharField(max_length=100, required=False, allow_blank=True)
+
+    def validate_name(self, value):
+        """
+        نام در جدولِ رتبه‌بندی به بچه‌های دیگر نشان داده می‌شود؛ شماره، لینک و
+        آیدی (راهِ تماس گرفتن با یک کودکِ غریبه) از آن حذف می‌شود. عمداً خطا
+        نمی‌دهد تا صفحه‌ی پروفایلِ اپ گیر نکند؛ فقط بقیه‌ی نام ذخیره می‌شود.
+        """
+        return clean_display_name(value)
     birthYear = serializers.IntegerField(required=False, allow_null=True,
                                          min_value=1300, max_value=1500)
     parentPhone = serializers.CharField(max_length=15, required=False, allow_blank=True)
@@ -127,3 +149,11 @@ class ProfileResponseSerializer(serializers.Serializer):
     birthYear = serializers.IntegerField(allow_null=True)
     parentPhone = serializers.CharField()
     bio = serializers.CharField()
+
+
+class LogoutRequestSerializer(serializers.Serializer):
+    refreshToken = serializers.CharField(required=False, allow_blank=True)
+
+
+class LogoutResponseSerializer(serializers.Serializer):
+    success = serializers.BooleanField()