Finishing a lesson or island needs recorded answers and an unlocked island; auto DB backup before migrate; throttles on 15 more routes

- content: POST nodes/{id}/quiz/complete and lessons/{id}/complete refuse a locked island
  (403 node_locked, same rule as /api/home) and a user who has not answered every question
  (409 answers_missing). Before, only a user with zero hearts and no answers was refused, so
  anyone else finished any island, locked or not, and finishing a locked island's lessons
  unlocked it. A node or lesson with no questions still passes when unlocked, with no XP.
  The client can no longer understate totalQuestions to buy stars.
- throttle_scope on 15 routes that had none (question bank without login, intro, hearts,
  notifications, tickets, plans, subscription status, orders, offers, affiliate, assistant
  history and feedback, logout).
- admin: OTPCode and Session can only be added/changed by a superuser.
- deploy.sh: integrity-checked DB backup before migrate (keeps the last 2); no migrate without it.
- docs and CLAUDE.md updated to say what is verified and what is not.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

progress/tests_live_gamification.py

@@ -78,10 +78,11 @@ class ActivityFeedsStreakAndLeaderboardTests(TestCase):
         self.assertEqual(len(calendar['activeDays']), 1)
 
     def test_a_finished_island_shows_up_on_the_leaderboard(self):
-        for question in Question.objects.filter(lesson__node=self.node).order_by('id')[:3]:
+        # آزمونِ چهارسوالی: هر چهار سوال جواب داده می‌شود (سه تا درست، یکی غلط)؛ پایان بی‌جواب پذیرفته نمی‌شود.
+        for index, question in enumerate(Question.objects.filter(lesson__node=self.node).order_by('id')[:4]):
             self.client.post(
                 f'/api/questions/{question.pk}/answer',
-                {'selectedOptionId': question.choices.get(is_correct=True).pk},
+                {'selectedOptionId': question.choices.get(is_correct=index < 3).pk},
                 content_type='application/json', **self.auth,
             )
         self.client.post(