make the domain configuration, not code: two env vars move everything

A domain change is coming (the Zarinpal terminal rejects the current callback
domain). ALLOWED_HOSTS, CSRF_TRUSTED_ORIGINS, CORS defaults, the Bazaar
redirect URI and deploy.sh's public health URL each spelled the domain out.
They now derive from PUBLIC_BASE_URL and FRONTEND_URL, which keep today's
domain as their default; env values for the three lists are still added on
top, so the old domain can stay allowed while DNS moves.

ZARINPAL_CALLBACK_URL used os.environ.get(key, default), so an empty key in
.env produced an empty callback and every payment would fail closed. It now
uses the same `.strip() or` fallback as its neighbours; the new test caught it.

config/tests_domains.py loads settings in a subprocess with a new domain and
fails if any derived value still mentions the old one. docs/operations.md
gains the step-by-step domain move (DNS, .env, Zarinpal/Bazaar panels,
frontend config.js, verification). CLAUDE.md records that the frontend is
now ours and where the rebuild stands. 624 tests green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy.sh

@@ -27,15 +27,15 @@ fail()  { printf '%s✖ %s%s\n' "$C_ERR" "$1" "$C_OFF" >&2; exit 1; }
 
 # اگر TADRISINO_HEALTH_URL ست نباشد چند آدرس امتحان می‌شود: پورتِ محلی ممکن
 # است فرق کند (سوکتِ یونیکس، پورتِ دیگر)، و در آن حالت دیپلویِ موفق هم پیامِ
-# خطا می‌گرفت. آدرسِ عمومی نشان می‌دهد سرویس واقعاً از بیرون جواب می‌دهد.
+# خطا می‌گرفت. آدرسِ عمومی نشان می‌دهد سرویس واقعاً از بیرون جواب می‌دهد؛ آن
+# را پایین‌تر، بعد از فعال شدنِ venv، از خودِ تنظیماتِ جنگو (PUBLIC_BASE_URL)
+# می‌خوانیم تا با عوض شدنِ دامنه این فایل دست نخورد.
 if [ -n "${TADRISINO_HEALTH_URL:-}" ]; then
   HEALTH_URLS=("$TADRISINO_HEALTH_URL")
 else
   HEALTH_URLS=(
     "http://127.0.0.1:8000/api/health"
     "http://127.0.0.1:8000/api/health/"
-    "https://api.math.tadrisino2.ir/api/health"
-    "https://api.math.tadrisino2.ir/api/health/"
   )
 fi
 
@@ -262,6 +262,12 @@ fi
 
 # ─── ۸. آیا واقعاً بالا آمد؟ ───────────────────────────────────────────────
 step "بررسیِ سلامت"
+if [ -z "${TADRISINO_HEALTH_URL:-}" ]; then
+  PUBLIC_URL="$(python -c 'import django, os; os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings"); django.setup(); from django.conf import settings; print(settings.PUBLIC_BASE_URL)' 2>/dev/null | tail -n 1)"
+  if [ -n "$PUBLIC_URL" ]; then
+    HEALTH_URLS+=("$PUBLIC_URL/api/health" "$PUBLIC_URL/api/health/")
+  fi
+fi
 CODE=000; BODY=""
 for attempt in 1 2 3 4 5 6 7 8 9 10; do
   for url in "${HEALTH_URLS[@]}"; do