Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

- Admin: refund/cancel/mark-resolved/Bazaar-link actions need change permission; question and
  curriculum import need add/delete; content browser needs view_question; guest device ids are
  shown to superusers only.
- Accounts: registering a guest's phone revokes the guest's earlier sessions; self-deletion keeps
  Redemption, UserOffer and the phone's OTP rows; the public demo guest cannot be deleted
  (DEMO_GUEST_DEVICE_IDS); display-name contact filter covers any separator and social handles.
- Payment: callback without Authority is 400; a second Bazaar purchase on a paid order is 409;
  orders snapshot credits/hearts/days at creation (payment.0011).
- Assistant: a broken diagram no longer makes a streamed answer free; a late off-topic marker
  refuses the answer (not stored, not cached); a disconnect saves the partial answer; only
  KNOWN_COLLECTIONS are searched.
- Infra: secret-key file is created atomically (workers no longer split keys); no default
  INTERNAL_SERVICE_KEY; Kavenegar key and Bazaar token kept out of error logs; Swagger/ReDoc
  pinned; schema throttled; docker compose bound to 127.0.0.1; non-ASCII digit ids are 400;
  ticket text capped at 5000.
- docs/security-before-production.md: remaining open items 24-31 and the guard tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/urls.py

@@ -13,6 +13,7 @@ from django.views import defaults as django_default_views
 from drf_spectacular.utils import extend_schema
 
 from config.health import HealthView
+from rest_framework.throttling import ScopedRateThrottle
 from drf_spectacular.views import (
     SpectacularAPIView,
     SpectacularRedocView,
@@ -46,6 +47,13 @@ def handler500(request):
     return django_default_views.server_error(request)
 
 
+class ThrottledSchemaView(SpectacularAPIView):
+    """بی‌ورود و بی‌کش: هر بار ~۵۶ms CPU و ۱۱۰KB؛ بی‌throttle چند ده درخواست در ثانیه workerها را پر می‌کرد."""
+
+    throttle_classes = [ScopedRateThrottle]
+    throttle_scope = 'read'
+
+
 urlpatterns = [
     path('admin/', admin.site.urls),
 
@@ -67,7 +75,7 @@ urlpatterns = [
     path('api/health/', HealthViewSlashAlias.as_view(), name='health-slash'),
 
     # OpenAPI schema + Swagger UI + Redoc
-    path('api/schema/', SpectacularAPIView.as_view(), name='schema'),
+    path('api/schema/', ThrottledSchemaView.as_view(), name='schema'),
     # قالبِ خودمان فقط یک پوسته‌ی راست‌به‌چپ روی قالبِ drf-spectacular است؛
     # بدونش متنِ فارسی در یک بلوکِ LTR رندر می‌شود و نقطه‌ی جمله و ترتیبِ
     # ستون‌های جدول جابه‌جا می‌شوند. توضیح در خودِ قالب.