tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/views.py

@@ -13,18 +13,16 @@ from rest_framework.views import APIView
 
 from . import bazaar, zarinpal
 from .models import Order
-from .permissions import HasInternalServiceKey, HasWebhookSecret
+from .permissions import HasInternalServiceKey
 from .serializers import (
     BazaarVerifyRequestSerializer,
     BazaarVerifyResponseSerializer,
     CreateOrderRequestSerializer,
     CreateOrderResponseSerializer,
     OrderDetailResponseSerializer,
-    WebhookRequestSerializer,
-    WebhookResponseSerializer,
     ZarinpalCallbackResponseSerializer,
 )
-from .services import apply_order_payment_result, create_order
+from .services import apply_order_payment_result, create_order, reconcile_pending_order
 
 
 def _redirect_to_configured_url(url: str) -> HttpResponseRedirect:
@@ -115,64 +113,6 @@ class CreateOrderView(APIView):
         return Response(CreateOrderResponseSerializer(data).data)
 
 
-class PaymentWebhookView(APIView):
-    """
-    POST /api/payment/webhook — وب‌هوکِ عمومیِ shared-secret (نه مخصوصِ زرین‌پال).
-
-    جریانِ واقعیِ زرین‌پال از PaymentRedirectView/ZarinpalCallbackView رد
-    می‌شه (زرین‌پال خودش webhookِ سرور-به-سرور نمی‌زنه، فقط مرورگرِ کاربر رو
-    ریدایرکت می‌کنه). این endpoint برای تاییدِ دستی/تستی یا درگاه‌های دیگه‌ای
-    که واقعاً webhook POST می‌زنن نگه داشته شده؛ محافظت‌شده با
-    HasWebhookSecret (هدر X-Webhook-Secret) تا هر کلاینتی نتونه با یک
-    orderId معتبر و status=paid، بدون پرداخت واقعی، اشتراک فعال کنه.
-    همچنین idempotent شده: اگه سفارش از قبل paid باشه، دوباره Transaction/
-    notify تکراری نمی‌سازه.
-    """
-
-    permission_classes = [HasWebhookSecret]
-    # این endpoint فقط با مقایسه‌ی هدرِ ثابتِ X-Webhook-Secret محافظت می‌شه،
-    # پس throttle لازمه تا حدسِ سکرت (یا fuzzِ orderId) محدود بمونه. چون
-    # caller خودِ درگاهه نه یک کاربرِ اپ، از ScopedRateThrottleِ IP-محور
-    # استفاده شده، نه الگویِ GuestAware*Throttle که نیازمندِ request.user است.
-    throttle_scope = 'payment_webhook'
-    throttle_classes = [ScopedRateThrottle]
-
-    # ⚠️ افزوده شده: مستندسازی هدر X-Webhook-Secret که قبلاً در Swagger UI
-    # قابل تنظیم/تست نبود.
-    @extend_schema(
-        request=WebhookRequestSerializer,
-        responses=WebhookResponseSerializer,
-        parameters=[
-            OpenApiParameter(
-                'X-Webhook-Secret', OpenApiTypes.STR, OpenApiParameter.HEADER, required=True,
-                description='کلید مخفیِ وب‌هوک درگاه پرداخت (settings.PAYMENT_WEBHOOK_SECRET).',
-            ),
-        ],
-        tags=['Payment (payment)'],
-    )
-    def post(self, request):
-        serializer = WebhookRequestSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-        v = serializer.validated_data
-        gateway_ref_id = v.get('gatewayRefId', '')
-
-        with transaction.atomic():
-            order = get_object_or_404(Order.objects.select_for_update(), pk=v['orderId'])
-            # ⚠️ اصلاح امنیتی/صحت داده (قبلی): هر بار فراخوانی webhook (حتی
-            # تکراری از سمت درگاه) یک Transaction جدید می‌ساخت. حالا این
-            # idempotency + اثرات جانبی (فعال‌سازی اشتراک/notify/statuslog)
-            # داخل apply_order_payment_result مشترکه (هم اینجا هم بازار).
-            apply_order_payment_result(
-                order=order,
-                gateway=v.get('gateway') or 'zarinpal',
-                gateway_ref_id=gateway_ref_id,
-                new_status=v['status'],
-                event='gateway_webhook',
-            )
-
-        return Response(WebhookResponseSerializer({'received': True}).data)
-
-
 class PaymentRedirectView(APIView):
     """
     GET /api/payment/orders/{id}/pay — همان paymentUrlی که
@@ -226,8 +166,7 @@ class ZarinpalCallbackView(APIView):
     GET /api/payment/zarinpal/callback — کال‌بکی که زرین‌پال بعدِ پرداخت،
     مرورگرِ کاربر رو بهش ریدایرکت می‌کنه (Authority, Status در query string).
 
-    برخلافِ PaymentWebhookView (یک POSTِ سرور-به-سرور با سکرتِ مشترک)،
-    اینجا caller خودِ مرورگرِ کاربره، نه زرین‌پال مستقیماً — پس هیچ
+    caller خودِ مرورگرِ کاربره، نه زرین‌پال مستقیماً — پس هیچ
     هدر/سکرتی برای اعتمادکردن نیست. امنیت از verify_payment میاد (یک
     فراخوانیِ سرور-به-سرور با Authority+amount): حتی اگه کاربر Status=OK
     رو دستی توی URL جعل کنه، بدونِ تاییدِ واقعیِ زرین‌پال چیزی paid نمی‌شه.
@@ -350,6 +289,8 @@ class OrderDetailView(APIView):
     @extend_schema(responses=OrderDetailResponseSerializer, tags=['Payment (payment)'])
     def get(self, request, order_id):
         order = get_object_or_404(Order, pk=order_id, user_id=request.user.id)
+        if reconcile_pending_order(order):
+            order.refresh_from_db()
         data = {
             'orderId': str(order.id),
             'status': order.status,