Implement critical security hardening and resolve a P0 bug in the
discount code consumption flow. This update transitions the system
from a development-heavy configuration to a production-ready state.
Key changes:
- Fix P0 bug where `consumeDiscountCode()` was missing, breaking order
registration; replaced with a robust `DiscountCodeService` using
`discount_code_usages` for audit trails and idempotency.
- Implement strict production guards for the Zarinpal payment gateway
to prevent accidental mock processing in live environments.
- Refactor WordPress bridge asset management to use `filemtime` based
versioning instead of `time()` to prevent unnecessary cache busting.
- Remove debug-only hacks (`opcache_reset`, `header` cache control)
from the WordPress plugin.
- Enhance file upload security by enforcing strict `mimetypes` validation.
- Update `.gitignore` to exclude sensitive WordPress configuration
files and local PHPUnit caches.
- Add comprehensive documentation for production deployment, including
security checklists and key rotation procedures.
- Update test suite to reflect new architecture and ensure 100%
coverage of the discount service.
- Add DEPLOYMENT_HANDOFF.md for client IT team with full production steps
- Fix ApiKeyMiddleware: correct Response import and fail-closed on unset key
- Remove committed Bridge API secret from all tracked docs
- Document seed, admin provisioning, WP user sync, Kavenegar, and wp-config hardening
- Reformat AGENT.md, README.md, CLIENT_DELIVERY.md to consistent structure
Refactor core documentation files to Persian and introduce a deployment handoff guide.
- Translate `AGENT.md`, `CLIENT_DELIVERY.md`, and `README.md` to Persian for better local stakeholder alignment
- Restructure `AGENT.md` with improved technical specifications and versioning
- Update `CLIENT_DELIVERY.md` with localized status legends and requirement tables
- Enhance `README.md` with detailed feature lists and improved formatting
- Add `DEPLOYMENT_HANDOFF.md` to facilitate production deployment processes
