let the Bazaar verify URL double as the OAuth redirect URI

The Bazaar account owner registered /api/payment/bazaar/verify as the
redirect URI. POST stays the app's purchase check; GET now takes Bazaar's
?code=, exchanges it for a refresh token and stores it in the new
BazaarCredential row, so connecting needs no SSH or .env edit.

The GET is unauthenticated, so it only acts inside a window opened from
the admin (or bazaar_authorize_link): 72 h by default, closed by the first
successful exchange, state checked when Bazaar echoes it. Authorize/token
URL shapes follow the known devapi v2 flow; not checked against Bazaar's
current docs, which did not load.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/management/commands/bazaar_authorize_link.py

@@ -0,0 +1,10 @@
+from django.core.management.base import BaseCommand
+
+from payment import bazaar
+
+
+class Command(BaseCommand):
+    help = 'لینکِ «اجازه»ی بازار را می‌سازد (همان actionِ ادمینِ «اتصال به API بازار»).'
+
+    def handle(self, *args, **options):
+        self.stdout.write(bazaar.start_authorization())