let the Bazaar verify URL double as the OAuth redirect URI

The Bazaar account owner registered /api/payment/bazaar/verify as the
redirect URI. POST stays the app's purchase check; GET now takes Bazaar's
?code=, exchanges it for a refresh token and stores it in the new
BazaarCredential row, so connecting needs no SSH or .env edit.

The GET is unauthenticated, so it only acts inside a window opened from
the admin (or bazaar_authorize_link): 72 h by default, closed by the first
successful exchange, state checked when Bazaar echoes it. Authorize/token
URL shapes follow the known devapi v2 flow; not checked against Bazaar's
current docs, which did not load.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/migrations/0008_bazaar_credential.py

@@ -0,0 +1,27 @@
+# Generated by Django 5.2.17 on 2026-09-26 17:50
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('payment', '0007_order_plan_id'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='BazaarCredential',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('refresh_token', models.TextField(blank=True)),
+                ('authorized_at', models.DateTimeField(blank=True, null=True)),
+                ('pending_state', models.CharField(blank=True, max_length=64)),
+                ('pending_since', models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                'verbose_name': 'اتصال به API بازار',
+                'verbose_name_plural': 'اتصال به API بازار',
+            },
+        ),
+    ]