tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

content/tests.py

@@ -28,11 +28,19 @@ class LessonCompleteImpossibleCountTests(TestCase):
         node = Node.objects.create(unit=unit, title='گره ۱', order=1)
         self.lesson = Lesson.objects.create(node=node, title='درس ۱', intro_text='...')
         for i in range(3):
-            Question.objects.create(
+            question = Question.objects.create(
                 lesson=self.lesson, type='multiple_choice', prompt=f'سوال {i}',
             )
+            Choice.objects.create(question=question, value='درست', is_correct=True)
 
     def _complete(self, correct_count, total_questions):
+        # مثلِ اپ: جواب‌ها اول ثبت می‌شوند؛ امتیاز فقط برای جوابِ ثبت‌شده است.
+        for question in self.lesson.questions.order_by('id')[:max(correct_count, 0)]:
+            self.client.post(
+                f'/api/questions/{question.id}/answer',
+                {'selectedOptionId': str(question.choices.get(is_correct=True).id)},
+                format='json', HTTP_AUTHORIZATION=f'Bearer {self.token}',
+            )
         return self.client.post(
             f'/api/lessons/{self.lesson.id}/complete',
             {'correctCount': correct_count, 'totalQuestions': total_questions},
@@ -79,11 +87,19 @@ class LessonCompleteRatioIgnoresClientTotalQuestionsTests(TestCase):
         node = Node.objects.create(unit=unit, title='گره ۲', order=1)
         self.lesson = Lesson.objects.create(node=node, title='درس ۲', intro_text='...')
         for i in range(3):
-            Question.objects.create(
+            question = Question.objects.create(
                 lesson=self.lesson, type='multiple_choice', prompt=f'سوال {i}',
             )
+            Choice.objects.create(question=question, value='درست', is_correct=True)
 
     def _complete(self, correct_count, total_questions):
+        # مثلِ اپ: جواب‌ها اول ثبت می‌شوند؛ امتیاز فقط برای جوابِ ثبت‌شده است.
+        for question in self.lesson.questions.order_by('id')[:max(correct_count, 0)]:
+            self.client.post(
+                f'/api/questions/{question.id}/answer',
+                {'selectedOptionId': str(question.choices.get(is_correct=True).id)},
+                format='json', HTTP_AUTHORIZATION=f'Bearer {self.token}',
+            )
         return self.client.post(
             f'/api/lessons/{self.lesson.id}/complete',
             {'correctCount': correct_count, 'totalQuestions': total_questions},
@@ -595,7 +611,8 @@ class HomeViewScalabilityTests(TestCase):
             self.assertEqual(self._home(g.id).status_code, 200)
         sql = ' '.join(e['sql'] for e in q).lower()
         self.assertNotIn('content_unit', sql)
-        self.assertNotIn('content_node', sql)
+        # content_nodeprogress دیتای کاربر است (جزیره‌های تمام‌شده)، نه برنامه‌ی درسی.
+        self.assertNotRegex(sql, r'content_node(?!progress)')
         # فقط کوئریِ per-user باید بمونه
         self.assertIn('userlessoncompletion', sql.replace('_', ''))