Audit fixes 2026-10-03: seed keeps admin edits, plan cache, refresh limit, payment and tutor guards

- seed_content no longer undoes admin work: a SeedRecord ledger (content/seed_sync.py)
  stops deleted/renamed/re-worded content from being recreated and keeps admin-edited
  lesson text; new rows in the seed files still arrive (migration content.0010)
- plan list cache is invalidated on Plan save (receiver used a stale 'v1' key)
- token refresh per-IP cap 30/hour -> 600/hour (TOKEN_REFRESH_IP_RATE)
- a failed gateway result only changes a pending order (forged NOK no longer
  overwrites refunded/canceled)
- tutor gets the correct answer only after the student has answered
- support reply notification moved to a TicketMessage post_save signal
- global daily cap on paid AI questions (AI_GLOBAL_DAILY_MAX, default 3000)
- Bazaar verify uses only the order's SKU; bazaar orders require a SKU
- /api/health warns on the committed signing key; deploy.sh saves local commits;
  400 for bad ?unit= / ?period=; account delete keeps the referrer's Conversion
- earlier today: no stub answers outside DEBUG, ?grade= removed, logged fallbacks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai_tutor/views.py

@@ -197,6 +197,28 @@ def _question_focus(v: dict, user) -> str:
     return question_focus(question_id, user.id)
 
 
+class AIDailyCapReached(APIException):
+    status_code = 503
+    default_detail = 'دستیار امروز به سقفِ استفاده رسیده؛ لطفاً فردا دوباره بپرس.'
+    default_code = 'ai_daily_cap'
+
+
+def _check_global_daily_cap() -> None:
+    """
+    سقفِ روزانه‌ی کلِ سامانه (AI_GLOBAL_DAILY_MAX): سوال‌های امروز که به مدل رفته‌اند یا با کش
+    برگشته‌اند ولی هنوز «free»/«credit» مانده‌اند. در دیتابیس شمرده می‌شود، پس بینِ workerها
+    مشترک است. داخلِ همان تراکنشِ IMMEDIATEِ فازِ ۱ صدا زده می‌شود؛ روی Postgres دو درخواستِ
+    هم‌زمان ممکن است هر دو از لبه رد شوند (چند سوال بیشتر از سقف، نه بیشتر).
+    """
+    from django.conf import settings
+
+    start = timezone.localtime().replace(hour=0, minute=0, second=0, microsecond=0)
+    used = Message.objects.filter(role='user', created_at__gte=start, charge__in=('free', 'credit')).count()
+    if used >= settings.AI_GLOBAL_DAILY_MAX:
+        logger.error('AI global daily cap reached: cap=%s used=%s', settings.AI_GLOBAL_DAILY_MAX, used)
+        raise AIDailyCapReached()
+
+
 class AIProviderUnavailable(APIException):
     """
     ⚠️ افزوده شده: وقتی generate_tutor_answer به یک AI provider واقعی
@@ -326,6 +348,8 @@ class AskAIView(APIView):
                 conversation__user_id=user.id, role='user', created_at__date=today, charge='free',
             ).count()
             quota = daily_quota(user.id)
+            if not screened:
+                _check_global_daily_cap()
             if screened:
                 charge = 'none'
             elif used_today < quota: