fix Bazaar purchase validation URLs and add the new pishkhan-token method

Read against Bazaar's own docs (wp-json of developers.cafebazaar.ir):
both validation URLs were wrong, so no real purchase could ever verify.
In-app is now api/validate/<pkg>/inapp/<sku>/purchases/<token>/, and
subscriptions add the missing /purchases/ and judge validUntil, since
that response has no purchaseState.

Only 404 means "not purchased"; 401/403/5xx now raise 503 so our own
key or quota trouble cannot mark a paid order failed. The client token
is URL-quoted so it cannot steer the request to another API path.

BAZAAR_PISHKHAN_API_SECRET (the documented new method, a static header
token with no OAuth) takes precedence when set; /api/health gains
integrations.bazaar. Not yet exercised by a real purchase.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/health.py

@@ -116,12 +116,21 @@ def _check_integrations() -> dict:
         'qdrant': bool(getattr(settings, 'QDRANT_API_KEY', '')),
         'openai': bool(getattr(settings, 'OPENAI_API_KEY', '')),
         'sms': bool(getattr(settings, 'KAVENEGAR_API_KEY', '')),
+        'bazaar': _bazaar_configured(),
         'aiProvider': _ai_provider_state(),
         'chatModel': getattr(settings, 'OPENAI_CHAT_MODEL', ''),
         'chatModelUpper': getattr(settings, 'OPENAI_CHAT_MODEL_UPPER', '') or None,
     }
 
 
+def _bazaar_configured() -> bool:
+    try:
+        from payment.bazaar import is_configured
+        return is_configured()
+    except Exception:
+        return False
+
+
 def _ai_provider_state() -> dict:
     try:
         from statuslog.models import StatusChangeLog

config/settings.py

@@ -723,6 +723,9 @@ BAZAAR_PACKAGE_NAME = os.environ.get('BAZAAR_PACKAGE_NAME', 'ir.tadrisino.app')
 BAZAAR_CLIENT_ID = os.environ.get('BAZAAR_CLIENT_ID', '')
 BAZAAR_CLIENT_SECRET = os.environ.get('BAZAAR_CLIENT_SECRET', '')
 BAZAAR_REFRESH_TOKEN = os.environ.get('BAZAAR_REFRESH_TOKEN', '')
+# روشِ جدیدِ بازار: توکنِ ثابتِ پیشخان (API پیشخان بازار ← دریافت توکن جدید).
+# اگر ست باشد بر OAuthِ بالا (CLIENT_ID/SECRET/REFRESH_TOKEN) مقدم است.
+BAZAAR_PISHKHAN_API_SECRET = os.environ.get('BAZAAR_PISHKHAN_API_SECRET', '').strip()
 BAZAAR_API_BASE = os.environ.get('BAZAAR_API_BASE', 'https://pardakht.cafebazaar.ir/devapi/v2')
 # Redirect URI که در پنل بازار ثبت شده؛ باید با آن *عیناً* یکی باشد. به
 # خواستِ مدیرِ حسابِ بازار (۲۰۲۶-۰۹-۲۶) همان آدرسِ verify است: GETِ آن codeِ