Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

- Admin: refund/cancel/mark-resolved/Bazaar-link actions need change permission; question and
  curriculum import need add/delete; content browser needs view_question; guest device ids are
  shown to superusers only.
- Accounts: registering a guest's phone revokes the guest's earlier sessions; self-deletion keeps
  Redemption, UserOffer and the phone's OTP rows; the public demo guest cannot be deleted
  (DEMO_GUEST_DEVICE_IDS); display-name contact filter covers any separator and social handles.
- Payment: callback without Authority is 400; a second Bazaar purchase on a paid order is 409;
  orders snapshot credits/hearts/days at creation (payment.0011).
- Assistant: a broken diagram no longer makes a streamed answer free; a late off-topic marker
  refuses the answer (not stored, not cached); a disconnect saves the partial answer; only
  KNOWN_COLLECTIONS are searched.
- Infra: secret-key file is created atomically (workers no longer split keys); no default
  INTERNAL_SERVICE_KEY; Kavenegar key and Bazaar token kept out of error logs; Swagger/ReDoc
  pinned; schema throttled; docker compose bound to 127.0.0.1; non-ASCII digit ids are 400;
  ticket text capped at 5000.
- docs/security-before-production.md: remaining open items 24-31 and the guard tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/admin.py

@@ -25,7 +25,7 @@ class OrderAdmin(admin.ModelAdmin):
     inlines = [TransactionInline]
     actions = ['cancel_pending', 'refund']
 
-    @admin.action(description='لغوِ سفارشِ در انتظار')
+    @admin.action(description='لغوِ سفارشِ در انتظار', permissions=['change'])
     def cancel_pending(self, request, queryset):
         from .services import OrderStateError, cancel_pending_order
 
@@ -39,7 +39,7 @@ class OrderAdmin(admin.ModelAdmin):
         if done:
             self.message_user(request, f'{done} سفارش لغو شد.', messages.SUCCESS)
 
-    @admin.action(description='بازپرداخت (پس گرفتنِ اعتبار/اشتراکِ سفارشِ پرداخت‌شده)')
+    @admin.action(description='بازپرداخت (پس گرفتنِ اعتبار/اشتراکِ سفارشِ پرداخت‌شده)', permissions=['change'])
     def refund(self, request, queryset):
         from django.template.response import TemplateResponse
 
@@ -97,7 +97,7 @@ class BazaarCredentialAdmin(admin.ModelAdmin):
     def has_add_permission(self, request):
         return False
 
-    @admin.action(description='ساختِ لینکِ اتصال به بازار')
+    @admin.action(description='ساختِ لینکِ اتصال به بازار', permissions=['change'])
     def make_authorize_link(self, request, queryset):
         url = bazaar.start_authorization()
         self.message_user(request, format_html(