tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai_tutor/provider_status.py

@@ -0,0 +1,65 @@
+"""
+وضعیتِ provider هوش مصنوعی (GapGPT): «کار می‌کند» یا «اعتبار تمام شده».
+
+چرا لازم است: ۲۰۲۶-۰۹-۲۵ اعتبارِ GapGPT تمام شد و دستیار برای همه‌ی کاربرها
+۵۰۳ داد («دستیار الان در دسترس نیست»)، در حالی که /api/health همچنان
+`openai: true` نشان می‌داد — چون فقط «کلید تنظیم شده» را می‌دید. تنها راهِ
+فهمیدنش خواندنِ لاگِ سرور بود.
+
+حالا هر گذار (ok → quota_exhausted و برعکس) یک ردیف در statuslog می‌شود:
+همه‌ی workerها آن را می‌بینند (کشِ LocMem این‌طور نیست) و /api/health
+گزارشش می‌کند. فقط گذار ثبت می‌شود، نه هر درخواست.
+"""
+import logging
+
+from django.core.cache import cache
+
+logger = logging.getLogger(__name__)
+
+LABEL = 'ai_tutor.Provider'
+OK = 'ok'
+EXHAUSTED = 'quota_exhausted'
+_CACHE_KEY = 'ai_tutor:provider_state'
+
+
+def current_state() -> str:
+    state = cache.get(_CACHE_KEY)
+    if state is None:
+        from statuslog.models import StatusChangeLog
+
+        state = (
+            StatusChangeLog.objects.filter(label=LABEL)
+            .values_list('new_status', flat=True).first()
+        ) or OK
+        cache.set(_CACHE_KEY, state, 60)
+    return state
+
+
+def _transition(new_state: str, event: str) -> None:
+    from statuslog.signals import status_changed
+
+    old_state = current_state()
+    if old_state == new_state:
+        return
+    status_changed.send(sender=LABEL, object_id=0, old_status=old_state,
+                        new_status=new_state, event=event)
+    cache.set(_CACHE_KEY, new_state, 60)
+
+
+def record_failure(exc) -> None:
+    """خطای provider؛ فقط تمام‌شدنِ اعتبار/سقفِ حساب وضعیت را عوض می‌کند."""
+    from rag.services.clients import is_account_limit
+
+    try:
+        if is_account_limit(exc):
+            _transition(EXHAUSTED, 'provider_account_limit')
+    except Exception:  # noqa: BLE001 — گزارش‌دهی نباید پاسخِ ۵۰۳ را خراب کند
+        logger.exception('provider_status: ثبتِ خطا شکست خورد')
+
+
+def record_success() -> None:
+    try:
+        if current_state() != OK:
+            _transition(OK, 'provider_recovered')
+    except Exception:  # noqa: BLE001
+        logger.exception('provider_status: ثبتِ بازگشت شکست خورد')