fix Bazaar purchase validation URLs and add the new pishkhan-token method

Read against Bazaar's own docs (wp-json of developers.cafebazaar.ir):
both validation URLs were wrong, so no real purchase could ever verify.
In-app is now api/validate/<pkg>/inapp/<sku>/purchases/<token>/, and
subscriptions add the missing /purchases/ and judge validUntil, since
that response has no purchaseState.

Only 404 means "not purchased"; 401/403/5xx now raise 503 so our own
key or quota trouble cannot mark a paid order failed. The client token
is URL-quoted so it cannot steer the request to another API path.

BAZAAR_PISHKHAN_API_SECRET (the documented new method, a static header
token with no OAuth) takes precedence when set; /api/health gains
integrations.bazaar. Not yet exercised by a real purchase.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/health.py

@@ -116,12 +116,21 @@ def _check_integrations() -> dict:
         'qdrant': bool(getattr(settings, 'QDRANT_API_KEY', '')),
         'openai': bool(getattr(settings, 'OPENAI_API_KEY', '')),
         'sms': bool(getattr(settings, 'KAVENEGAR_API_KEY', '')),
+        'bazaar': _bazaar_configured(),
         'aiProvider': _ai_provider_state(),
         'chatModel': getattr(settings, 'OPENAI_CHAT_MODEL', ''),
         'chatModelUpper': getattr(settings, 'OPENAI_CHAT_MODEL_UPPER', '') or None,
     }
 
 
+def _bazaar_configured() -> bool:
+    try:
+        from payment.bazaar import is_configured
+        return is_configured()
+    except Exception:
+        return False
+
+
 def _ai_provider_state() -> dict:
     try:
         from statuslog.models import StatusChangeLog