fix(iab): correct package name to com.bargevasat.app + slot for Bazaar RSA key

- storeBilling.ts and IabService PackageName defaulted to com.bargevasat.hokm,
  but the real app id is com.bargevasat.app (capacitor + android applicationId).
  The mismatch would break Bazaar deep-link purchases and server validation.
- Add IabOptions.BazaarRsaPublicKey to hold the Bazaar in-app billing RSA public
  key (documented; for the Poolakey local-signature flow, unused by the current
  deep-link + server pardakht verification).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/Hokm.Server/Payments/IabService.cs

@@ -11,13 +11,22 @@ namespace Hokm.Server.Payments;
 public sealed class IabOptions
 {
     /// <summary>Android package name registered in the store panels.</summary>
-    public string PackageName { get; set; } = "com.bargevasat.hokm";
+    public string PackageName { get; set; } = "com.bargevasat.app";
 
     // ── Cafe Bazaar (pardakht dev API, OAuth refresh-token flow) ──
     public string BazaarClientId { get; set; } = "";
     public string BazaarClientSecret { get; set; } = "";
     public string BazaarRefreshToken { get; set; } = "";
 
+    /// <summary>
+    /// Cafe Bazaar in-app billing RSA public key (panel: «دریافت کلید RSA برای
+    /// قراردادن در برنامه»). Used to verify a purchase payload's signature locally
+    /// (Poolakey in-app library flow). NOT used by the current deep-link flow,
+    /// which verifies server-to-server via the pardakht API above — kept here so
+    /// the key has a home if/when the native Poolakey plugin is added.
+    /// </summary>
+    public string BazaarRsaPublicKey { get; set; } = "";
+
     // ── Myket (developer validation API) ──
     public string MyketAccessToken { get; set; } = "";