Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

- Admin: refund/cancel/mark-resolved/Bazaar-link actions need change permission; question and
  curriculum import need add/delete; content browser needs view_question; guest device ids are
  shown to superusers only.
- Accounts: registering a guest's phone revokes the guest's earlier sessions; self-deletion keeps
  Redemption, UserOffer and the phone's OTP rows; the public demo guest cannot be deleted
  (DEMO_GUEST_DEVICE_IDS); display-name contact filter covers any separator and social handles.
- Payment: callback without Authority is 400; a second Bazaar purchase on a paid order is 409;
  orders snapshot credits/hearts/days at creation (payment.0011).
- Assistant: a broken diagram no longer makes a streamed answer free; a late off-topic marker
  refuses the answer (not stored, not cached); a disconnect saves the partial answer; only
  KNOWN_COLLECTIONS are searched.
- Infra: secret-key file is created atomically (workers no longer split keys); no default
  INTERNAL_SERVICE_KEY; Kavenegar key and Bazaar token kept out of error logs; Swagger/ReDoc
  pinned; schema throttled; docker compose bound to 127.0.0.1; non-ASCII digit ids are 400;
  ticket text capped at 5000.
- docs/security-before-production.md: remaining open items 24-31 and the guard tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rag/tests.py

@@ -65,7 +65,8 @@ class _FakeQdrant:
         return SimpleNamespace(points=pts)
 
 
-@override_settings(**RAG_ON)
+# «علوم تجربی سوم» در KNOWN_COLLECTIONS هست؛ collectionِ ناشناخته اصلاً جستجو نمی‌شود.
+@override_settings(**{**RAG_ON, 'RAG_GRADE_TITLE_OVERRIDES': {1: 'سوم'}})
 class AskAIRagPathTests(TestCase):
     def setUp(self):
         cache.clear()
@@ -129,6 +130,7 @@ class IngestTextTests(TestCase):
         reset_clients_cache()
         self.client = APIClient()
 
+    @override_settings(INTERNAL_SERVICE_KEY='test-internal-key')
     def test_ingest_text_creates_chunks(self):
         qdrant = _FakeQdrant()
         reply = '{"summary": "خلاصه‌ی این تکه."}'
@@ -142,7 +144,7 @@ class IngestTextTests(TestCase):
                     'text': 'الف' * 900,
                 },
                 format='json',
-                HTTP_X_INTERNAL_KEY='dev-internal-service-key-change-me',
+                HTTP_X_INTERNAL_KEY='test-internal-key',
             )
         self.assertEqual(resp.status_code, 200, resp.content)
         self.assertGreater(resp.data['chunksCreated'], 0)