send the Bazaar access token without "Bearer" and cap its cache at an hour

Tried against the real Bazaar API on 2026-09-26 after the first live
authorization: "Authorization: Bearer <t>" gets 403 "Access token is not
valid", the bare token is accepted, even though token_type says Bearer.
The refresh grant also returned expires_in=3600000, which the old code
would have cached for ~41 days; the TTL is now capped at one hour and
401/403 clear it.

404 invalid_value (wrong package or SKU) is our misconfiguration, so it
now raises 503 instead of failing the user's order; only error=not_found
means "not purchased", as Bazaar's docs say.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/tests.py

@@ -119,7 +119,7 @@ class BazaarVerifyPurchaseFailClosedTests(TestCase):
         self.assertTrue(result.is_valid)
         mock_get.assert_called_once()
         _, get_kwargs = mock_get.call_args
-        self.assertEqual(get_kwargs['headers']['Authorization'], 'Bearer real-access-token')
+        self.assertEqual(get_kwargs['headers']['Authorization'], 'real-access-token')
 
     @override_settings(
         BAZAAR_REFRESH_TOKEN='refresh-token-xyz',