Signed payment links, hashed refresh tokens, login-only leaderboard, load test tools

- /api/payment/orders/{id}/pay requires the short-lived signature that paymentUrl carries;
  without it (or with another order's) it is the same 404 as an unknown order
- Session.refresh_token stores the SHA-256 of the token; migration accounts.0007 hashes the
  existing rows so tokens clients already hold keep working
- /api/leaderboard requires a token (guests have one); names of children were scrapable
- RAG mock only for `manage.py test`, not any command with an argument named "test"
- tools/loadtest: user factory, load generator, fake GapGPT+Qdrant, with method notes
- security-before-production.md lists only open items; closed ones become a guards table
  with the tests that hold them. Comments describe current behaviour, not history

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

accounts/management/commands/seed_test_data.py

@@ -37,7 +37,7 @@ from django.db import transaction
 from django.utils import timezone
 
 from accounts.authentication import issue_access_token
-from accounts.models import OTPCode, Profile, Session, User
+from accounts.models import OTPCode, Profile, Session, User, hash_refresh_token
 
 # --- شناسه‌های ثابتِ داده‌ی seed --------------------------------------------
 # شماره‌های 0912000000X عمداً خارج از بازه‌ی واقعیِ اپراتورهای ایران نیستن؛
@@ -177,7 +177,7 @@ class Command(BaseCommand):
         )
         Session.objects.get_or_create(
             user=main_user,
-            refresh_token=f'seed-refresh-{MAIN_PHONE}',
+            refresh_token=hash_refresh_token(f'seed-refresh-{MAIN_PHONE}'),
             defaults=dict(
                 device_id='seed-device-main',
                 expires_at=timezone.now() + timedelta(days=settings.REFRESH_TOKEN_TTL_DAYS),
@@ -192,7 +192,7 @@ class Command(BaseCommand):
         )
         Session.objects.get_or_create(
             user=guest_user,
-            refresh_token=f'seed-refresh-{GUEST_DEVICE_ID}',
+            refresh_token=hash_refresh_token(f'seed-refresh-{GUEST_DEVICE_ID}'),
             defaults=dict(
                 device_id=GUEST_DEVICE_ID,
                 expires_at=timezone.now() + timedelta(days=settings.REFRESH_TOKEN_TTL_DAYS),