tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

progress/migrations/0004_seyar_characters.py

@@ -0,0 +1,38 @@
+"""
+سه‌یارِ اپ (سیگما، دلتا، پی) به‌عنوانِ کاراکترهای واقعیِ کاتالوگ.
+
+فرانت از ۲۰۲۶-۰۹-۲۴ صفحه‌ی «همراهت رو انتخاب کن» دارد و فقط slugهای
+sigma/delta/pi را با طرحِ انیمیشن‌دارِ خودش نشان می‌دهد؛ هر slugِ دیگری کارتِ
+عمومی می‌گیرد. تا امروز کاتالوگ روی سرور یا خالی بود یا فقط ردیف‌های [SEED]
+داشت. این‌ها با get_or_create ساخته می‌شوند، پس اگر بعداً از ادمین
+ویرایش شوند (نام، امتیازِ باز شدن)، اجرای دوباره چیزی را برنمی‌گرداند.
+
+امتیازِ باز شدن تصمیمِ محصولی است و از ادمین قابلِ تغییر است؛ ۱۰ امتیاز برای
+هر جوابِ درست، یعنی دلتا بعد از ~۱۰ و پی بعد از ~۳۰ جوابِ درست.
+"""
+from django.db import migrations
+
+SEYAR = [
+    ('sigma', 'سیگما', 0, 1),
+    ('delta', 'دلتا', 100, 2),
+    ('pi', 'پی', 300, 3),
+]
+
+
+def create(apps, schema_editor):
+    Character = apps.get_model('progress', 'Character')
+    for slug, name, unlock_xp, order in SEYAR:
+        Character.objects.get_or_create(
+            slug=slug,
+            defaults={'name': name, 'icon': slug, 'unlock_xp': unlock_xp, 'order': order},
+        )
+
+
+def remove(apps, schema_editor):
+    apps.get_model('progress', 'Character').objects.filter(
+        slug__in=[s for s, *_ in SEYAR]).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [('progress', '0003_userhearts_full_refill_at')]
+    operations = [migrations.RunPython(create, remove)]