Audit fixes 2026-10-03: seed keeps admin edits, plan cache, refresh limit, payment and tutor guards

- seed_content no longer undoes admin work: a SeedRecord ledger (content/seed_sync.py)
  stops deleted/renamed/re-worded content from being recreated and keeps admin-edited
  lesson text; new rows in the seed files still arrive (migration content.0010)
- plan list cache is invalidated on Plan save (receiver used a stale 'v1' key)
- token refresh per-IP cap 30/hour -> 600/hour (TOKEN_REFRESH_IP_RATE)
- a failed gateway result only changes a pending order (forged NOK no longer
  overwrites refunded/canceled)
- tutor gets the correct answer only after the student has answered
- support reply notification moved to a TicketMessage post_save signal
- global daily cap on paid AI questions (AI_GLOBAL_DAILY_MAX, default 3000)
- Bazaar verify uses only the order's SKU; bazaar orders require a SKU
- /api/health warns on the committed signing key; deploy.sh saves local commits;
  400 for bad ?unit= / ?period=; account delete keeps the referrer's Conversion
- earlier today: no stub answers outside DEBUG, ?grade= removed, logged fallbacks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/services.py

@@ -133,6 +133,12 @@ def apply_order_payment_result(*, order: Order, gateway: str, gateway_ref_id: st
         # از قبل paid شده را به عقب برگرداند؛ چنین callback ای idempotent/no-op است.
         if already_paid and new_status != 'paid':
             is_duplicate = True
+        # نتیجه‌ی ناموفق فقط سفارشِ «در انتظار» را عوض می‌کند. کال‌بکِ زرین‌پال بی‌احراز است و
+        # authority از هدرِ Location ِ /pay خوانده می‌شود؛ تا ۲۰۲۶-۱۰-۰۳ یک Status=NOKِ جعلی سفارشِ
+        # «بازپرداخت‌شده» یا «لغوشده» را «ناموفق» می‌کرد و ردِ بازپرداخت از وضعیتِ سفارش می‌رفت
+        # (بازتولید شد). «paid» عمداً از این قاعده بیرون است: کسی که پول داده باید چیزش را بگیرد.
+        if new_status != 'paid' and old_status != 'pending':
+            is_duplicate = True
 
         # reuse رفرنسِ پرداخت روی سفارش دیگر هم duplicate/no-op در نظر گرفته می‌شود.
         if gateway_ref_id and Transaction.objects.filter(