Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

- Admin: refund/cancel/mark-resolved/Bazaar-link actions need change permission; question and
  curriculum import need add/delete; content browser needs view_question; guest device ids are
  shown to superusers only.
- Accounts: registering a guest's phone revokes the guest's earlier sessions; self-deletion keeps
  Redemption, UserOffer and the phone's OTP rows; the public demo guest cannot be deleted
  (DEMO_GUEST_DEVICE_IDS); display-name contact filter covers any separator and social handles.
- Payment: callback without Authority is 400; a second Bazaar purchase on a paid order is 409;
  orders snapshot credits/hearts/days at creation (payment.0011).
- Assistant: a broken diagram no longer makes a streamed answer free; a late off-topic marker
  refuses the answer (not stored, not cached); a disconnect saves the partial answer; only
  KNOWN_COLLECTIONS are searched.
- Infra: secret-key file is created atomically (workers no longer split keys); no default
  INTERNAL_SERVICE_KEY; Kavenegar key and Bazaar token kept out of error logs; Swagger/ReDoc
  pinned; schema throttled; docker compose bound to 127.0.0.1; non-ASCII digit ids are 400;
  ticket text capped at 5000.
- docs/security-before-production.md: remaining open items 24-31 and the guard tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/tests.py

@@ -46,7 +46,7 @@ class SecretDefaultsFailClosedTests(TestCase):
         )
         self.assertTrue(HasInternalServiceKey().has_permission(internal_request, None))
 
-    def test_debug_mode_local_fallback_still_valid(self):
+    def test_debug_mode_has_no_default_internal_key(self):
         # settings.py این مقادیر رو یک‌بار موقعِ import محاسبه می‌کنه، نه
         # چیزی که override_settings بعداً toggle کنه؛ پس برای تستِ این
         # منطق باید خودِ ماژول رو reload کرد.
@@ -63,10 +63,8 @@ class SecretDefaultsFailClosedTests(TestCase):
             with patch.dict(os.environ, clean_env, clear=True):
                 importlib.reload(settings_module)
                 self.assertTrue(settings_module.DEBUG)
-                self.assertEqual(
-                    settings_module.INTERNAL_SERVICE_KEY,
-                    'dev-internal-service-key-change-me',
-                )
+                # رشته‌ی پیش‌فرضِ داخلِ ریپو هر لپ‌تاپِ توسعه‌ی بازِ روی شبکه را به ingest راه می‌داد.
+                self.assertEqual(settings_module.INTERNAL_SERVICE_KEY, '')
         finally:
             # همیشه ماژول رو به حالتِ واقعیِ محیطِ تست برمی‌گردونیم تا روی
             # بقیه‌ی تست‌ها اثر نذاره.