Audit fixes 2026-10-03: seed keeps admin edits, plan cache, refresh limit, payment and tutor guards

- seed_content no longer undoes admin work: a SeedRecord ledger (content/seed_sync.py)
  stops deleted/renamed/re-worded content from being recreated and keeps admin-edited
  lesson text; new rows in the seed files still arrive (migration content.0010)
- plan list cache is invalidated on Plan save (receiver used a stale 'v1' key)
- token refresh per-IP cap 30/hour -> 600/hour (TOKEN_REFRESH_IP_RATE)
- a failed gateway result only changes a pending order (forged NOK no longer
  overwrites refunded/canceled)
- tutor gets the correct answer only after the student has answered
- support reply notification moved to a TicketMessage post_save signal
- global daily cap on paid AI questions (AI_GLOBAL_DAILY_MAX, default 3000)
- Bazaar verify uses only the order's SKU; bazaar orders require a SKU
- /api/health warns on the committed signing key; deploy.sh saves local commits;
  400 for bad ?unit= / ?period=; account delete keeps the referrer's Conversion
- earlier today: no stub answers outside DEBUG, ?grade= removed, logged fallbacks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

content/management/commands/seed_content.py

@@ -24,7 +24,7 @@ from pathlib import Path
 from django.core.management.base import BaseCommand, CommandError
 from django.db import transaction
 
-from content import curriculum_io, question_io
+from content import curriculum_io, question_io, seed_sync
 from content.models import Grade, Lesson, Question
 
 # ردیف‌های نمونه هرگز نباید در فایلِ ریپو بنشینند: این فایل مستقیم روی
@@ -119,10 +119,10 @@ class Command(BaseCommand):
 
         # dry-run با rollback انجام می‌شود، نه با شمارشِ تقریبی: تنها چیزی که
         # واقعاً می‌گوید چه اتفاقی می‌افتد، خودِ اتفاق است.
+        # seed_sync کارِ ادمین (حذف، تغییرِ نام، اصلاحِ متن) را برنمی‌گرداند؛ شرح در خودِ ماژول.
         try:
             with transaction.atomic():
-                counts = curriculum_io.import_curriculum(grades)
-                question_counts = self._load_questions()
+                counts = seed_sync.sync(grades, self._question_rows())
                 if dry_run:
                     transaction.set_rollback(True)
         except (curriculum_io.CurriculumError, question_io.ImportError_) as exc:
@@ -134,23 +134,20 @@ class Command(BaseCommand):
             f'{counts["grades"]} پایه، {counts["units"]} فصل، '
             f'{counts["nodes"]} مبحث، {counts["lessons"]} درسِ تازه '
             f'({counts["updated"]} درس به‌روز شد)؛ '
-            f'{question_counts["created"]} سوالِ تازه '
-            f'({question_counts["skipped"]} سوال از قبل بود)'
+            f'{counts["created"]} سوالِ تازه '
+            f'({counts["skipped"]} سوال از قبل بود)'
         ))
+        if counts['retired'] or counts['kept_admin_text']:
+            self.stdout.write(
+                f'  {counts["retired"]} موردِ فایل ساخته نشد چون ادمین پاکش کرده یا نامش را عوض کرده؛ '
+                f'{counts["kept_admin_text"]} متنِ درس که ادمین ویرایش کرده دست نخورد.'
+            )
 
-    def _load_questions(self) -> dict:
+    def _question_rows(self) -> list:
         if not QUESTIONS_FILE.exists():
-            return {'created': 0, 'skipped': 0}
-
+            return []
         raw = json.loads(QUESTIONS_FILE.read_text(encoding='utf-8'))
-        rows = raw.get('questions', raw) if isinstance(raw, dict) else raw
-        if not rows:
-            return {'created': 0, 'skipped': 0}
-
-        # مسیرِ عنوان → lessonId، سپس همان اعتبارسنجیِ همیشگیِ question_io.
-        resolved = question_io.resolve_paths(rows)
-        parsed = question_io.parse(json.dumps(resolved).encode('utf-8'))
-        return question_io.import_questions(parsed, skip_existing=True)
+        return (raw.get('questions', raw) if isinstance(raw, dict) else raw) or []
 
 
 def _has_questions(path: Path) -> bool: