connect Zarinpal as the real payment gateway

payment.services.call_payment_gateway was a stub returning a fake
payment.gateway/pay/{id} URL. It's replaced with a real Zarinpal
integration (payment/zarinpal.py, Payment API v4):

- create_order/CreateOrderView still never call Zarinpal directly —
  paymentUrl points at our own GET /api/payment/orders/{id}/pay
  (PaymentRedirectView), which requests the real Zarinpal authority on
  first visit and redirects to StartPay. This keeps order creation from
  depending on Zarinpal's uptime/latency, and means none of the existing
  purchase/idempotency tests needed to change.
- GET /api/payment/zarinpal/callback (ZarinpalCallbackView) is where
  Zarinpal redirects the user back to; it always re-verifies
  server-to-server via zarinpal.verify_payment before marking an order
  paid, so a forged Status=OK in the query string alone does nothing.
- zarinpal.py fails closed (503 / invalid) when ZARINPAL_MERCHANT_ID
  isn't configured, matching payment/bazaar.py's existing convention —
  never a fake successful payment.

Adds Order.gateway_authority, PUBLIC_BASE_URL/ZARINPAL_* settings, and
a payment_pay throttle scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -53,6 +53,19 @@ RAG_RETRIEVAL_TOP_K=4
 # RAG_FORCE_MOCK=1  یعنی حتی با وجودِ کلیدها هم مسیرِ RAG خاموش بمونه.
 RAG_FORCE_MOCK=
 
+# -----------------------------------------------------------------------
+# زرین‌پال (اپ payment) — درگاهِ اصلیِ پرداختِ ما
+# -----------------------------------------------------------------------
+# بدونِ ZARINPAL_MERCHANT_ID، مسیرِ پرداخت fail-closed می‌مونه (خطای صریحِ
+# ۵۰۳ به‌جایِ پرداختِ ساختگیِ موفق).
+PUBLIC_BASE_URL=
+ZARINPAL_MERCHANT_ID=
+# 1 = محیطِ sandbox زرین‌پال (برای تست بدونِ پرداختِ واقعی)
+ZARINPAL_SANDBOX=1
+# اختیاری — بعدِ تاییدِ پرداخت، کاربر به این URL (مثلاً یک deep link اپ) با
+# ?orderId=...&status=... ریدایرکت می‌شه. خالی = پاسخِ JSON ساده.
+ZARINPAL_REDIRECT_URL=
+
 # -----------------------------------------------------------------------
 # تنظیماتِ مقیاس‌پذیری (همه دیفالتِ امن دارن)
 # -----------------------------------------------------------------------