Signed payment links, hashed refresh tokens, login-only leaderboard, load test tools

- /api/payment/orders/{id}/pay requires the short-lived signature that paymentUrl carries;
  without it (or with another order's) it is the same 404 as an unknown order
- Session.refresh_token stores the SHA-256 of the token; migration accounts.0007 hashes the
  existing rows so tokens clients already hold keep working
- /api/leaderboard requires a token (guests have one); names of children were scrapable
- RAG mock only for `manage.py test`, not any command with an argument named "test"
- tools/loadtest: user factory, load generator, fake GapGPT+Qdrant, with method notes
- security-before-production.md lists only open items; closed ones become a guards table
  with the tests that hold them. Comments describe current behaviour, not history

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

progress/views.py

@@ -127,8 +127,14 @@ LEADERBOARD_CACHE_TTL = 60
 
 
 class LeaderboardView(APIView):
-    """GET /api/leaderboard?period= — رتبه‌بندی هفتگی/ماهانه"""
+    """
+    GET /api/leaderboard?period= — رتبه‌بندی هفتگی/ماهانه
 
+    فقط برای کاربرِ واردشده (مهمان هم توکن دارد): پاسخ نامِ کاربران، که بیشترشان کودک‌اند،
+    و شناسه‌ی داخلی‌شان را دارد و بدونِ ورود برای هر کسی در اینترنت قابلِ جمع‌آوری بود.
+    """
+
+    permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
     throttle_classes = [GuestAwareReadThrottle]