config: fix IAB package name + flatten Production Iab example

- appsettings.json + docker-compose default: PackageName com.bargevasat.hokm →
  com.bargevasat.app (the validate API URL embeds it; wrong value breaks
  Bazaar/Myket token verification).
- appsettings.Production.json.example: Iab keys were nested (Iab.Bazaar.*,
  Iab.Myket.*) which don't bind to the flat IabOptions; flattened to
  PackageName / BazaarClientId / ... / MyketAccessToken.

MyketAccessToken is already wired end to end: ENV_FILE IAB_MYKET_ACCESS_TOKEN →
compose Iab__MyketAccessToken → IabOptions.MyketAccessToken → VerifyMyket.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -57,7 +57,7 @@ services:
       Zarinpal__CallbackUrl: ${ZARINPAL_CALLBACK_URL:-http://localhost:1505/api/coins/pay/callback}
       Zarinpal__ClientReturnUrl: ${ZARINPAL_CLIENT_RETURN_URL:-http://localhost:1500}
       # Store in-app billing verification (Cafe Bazaar / Myket) — fill from panels.
-      Iab__PackageName: ${IAB_PACKAGE_NAME:-com.bargevasat.hokm}
+      Iab__PackageName: ${IAB_PACKAGE_NAME:-com.bargevasat.app}
       Iab__BazaarClientId: ${IAB_BAZAAR_CLIENT_ID:-}
       Iab__BazaarClientSecret: ${IAB_BAZAAR_CLIENT_SECRET:-}
       Iab__BazaarRefreshToken: ${IAB_BAZAAR_REFRESH_TOKEN:-}

server/src/Hokm.Server/appsettings.Production.json.example

@@ -22,17 +22,12 @@
     "ClientReturnUrl": "https://bargevasat.ir"
   },
   "Iab": {
-    "// note": "Cafe Bazaar / Myket in-app purchase. Fill after publishing & getting store creds.",
+    "// note": "Cafe Bazaar / Myket in-app purchase. Fill after publishing & getting store creds. Keys are FLAT (must match IabOptions).",
-    "AllowUnverified": false,
-    "Bazaar": {
     "PackageName": "com.bargevasat.app",
-      "ClientId": "<bazaar-client-id>",
+    "BazaarClientId": "<bazaar-client-id>",
-      "ClientSecret": "<bazaar-client-secret>",
+    "BazaarClientSecret": "<bazaar-client-secret>",
-      "RefreshToken": "<bazaar-refresh-token>"
+    "BazaarRefreshToken": "<bazaar-refresh-token>",
-    },
+    "MyketAccessToken": "<myket-access-token>",
-    "Myket": {
+    "AllowUnverified": false
-      "PackageName": "com.bargevasat.app",
-      "AccessToken": "<myket-access-token>"
-    }
   }
 }

server/src/Hokm.Server/appsettings.json

@@ -25,7 +25,7 @@
     "ClientReturnUrl": "http://localhost:3000"
   },
   "Iab": {
-    "PackageName": "com.bargevasat.hokm",
+    "PackageName": "com.bargevasat.app",
     "BazaarClientId": "",
     "BazaarClientSecret": "",
     "BazaarRefreshToken": "",