tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/middleware.py

@@ -110,3 +110,42 @@ class APINoStoreMiddleware:
         if request.path.startswith(_LOGGED_PATH_PREFIX) and not response.has_header('Cache-Control'):
             response['Cache-Control'] = 'private, no-store'
         return response
+
+
+class AdminLoginThrottleMiddleware:
+    """
+    سقفِ تلاشِ ورود به /admin/ برای هر IP (ADMIN_LOGIN_MAX_ATTEMPTS در ۱۵ دقیقه).
+
+    پنلِ ادمین روی دامنه‌ی عمومی است و فرمِ ورودِ جنگو هیچ محدودیتی ندارد؛
+    یعنی رمزِ ادمین (که همه‌ی محتوا و پرداخت‌ها را کنترل می‌کند) بی‌سقف قابلِ
+    حدس زدن بود. شمارش در کشِ پیش‌فرض است: تا CACHE_URL (Redis) تنظیم نشده،
+    برای هر worker جدا — یعنی سقفِ واقعی تا سه برابر. IP با همان منطقِ
+    NUM_PROXIESِ throttleهای DRF خوانده می‌شود.
+    """
+
+    WINDOW_SECONDS = 15 * 60
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if request.method == 'POST' and request.path.startswith('/admin/login'):
+            from django.conf import settings
+            from django.core.cache import cache
+            from django.http import HttpResponse
+            from rest_framework.throttling import BaseThrottle
+
+            key = f'admin_login:{BaseThrottle().get_ident(request)}'
+            cache.add(key, 0, self.WINDOW_SECONDS)
+            try:
+                attempts = cache.incr(key)
+            except ValueError:
+                cache.set(key, 1, self.WINDOW_SECONDS)
+                attempts = 1
+            if attempts > getattr(settings, 'ADMIN_LOGIN_MAX_ATTEMPTS', 10):
+                logger.warning('admin login throttled: ident=%s attempts=%s', key, attempts)
+                return HttpResponse(
+                    'تلاشِ ورود بیش از حد مجاز است؛ ۱۵ دقیقه‌ی دیگر دوباره امتحان کنید.',
+                    status=429, content_type='text/plain; charset=utf-8',
+                )
+        return self.get_response(request)