Implement critical security hardening and resolve a P0 bug in the
discount code consumption flow. This update transitions the system
from a development-heavy configuration to a production-ready state.
Key changes:
- Fix P0 bug where `consumeDiscountCode()` was missing, breaking order
registration; replaced with a robust `DiscountCodeService` using
`discount_code_usages` for audit trails and idempotency.
- Implement strict production guards for the Zarinpal payment gateway
to prevent accidental mock processing in live environments.
- Refactor WordPress bridge asset management to use `filemtime` based
versioning instead of `time()` to prevent unnecessary cache busting.
- Remove debug-only hacks (`opcache_reset`, `header` cache control)
from the WordPress plugin.
- Enhance file upload security by enforcing strict `mimetypes` validation.
- Update `.gitignore` to exclude sensitive WordPress configuration
files and local PHPUnit caches.
- Add comprehensive documentation for production deployment, including
security checklists and key rotation procedures.
- Update test suite to reflect new architecture and ensure 100%
coverage of the discount service.
b9ede16613