fix(iab): correct package name to com.bargevasat.app + slot for Bazaar RSA key

- storeBilling.ts and IabService PackageName defaulted to com.bargevasat.hokm,
  but the real app id is com.bargevasat.app (capacitor + android applicationId).
  The mismatch would break Bazaar deep-link purchases and server validation.
- Add IabOptions.BazaarRsaPublicKey to hold the Bazaar in-app billing RSA public
  key (documented; for the Poolakey local-signature flow, unused by the current
  deep-link + server pardakht verification).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/storeBilling.ts

@@ -16,7 +16,7 @@ import { CoinPack } from "./online/types";
 export type StoreId = "bazaar" | "myket" | "web";
 
 const ENV_STORE = ((process.env.NEXT_PUBLIC_STORE as StoreId | undefined) ?? "web");
-const PACKAGE = process.env.NEXT_PUBLIC_APP_PACKAGE ?? "com.bargevasat.hokm";
+const PACKAGE = process.env.NEXT_PUBLIC_APP_PACKAGE ?? "com.bargevasat.app";
 const PENDING_SKU_KEY = "iab_pending_sku";
 
 /** Native bridge contract a Myket Capacitor plugin must fulfil. */