Add ZarinPal sandbox payments for buying coins (config-driven merchant)

- ZarinpalService (request/verify) + /api/coins/pay/request (JWT) and
  /api/coins/pay/callback (verify → credit via ProfileService.BuyCoins → redirect
  back with ?pay=success); merchant id from config (sandbox default)
- Client buyCoins (live) returns the StartPay redirect URL; BuyCoinsScreen
  redirects; page.tsx handles the ?pay return (notify + refresh)
- Verified: sandbox request returns a real StartPay URL
- Documented Cafe Bazaar (Poolakey) / Myket IAB as the required store payment path

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ANDROID.md

@@ -51,6 +51,21 @@ On a CI box with JDK 21 + build-tools 35 you can drop those overrides.
 > Remote storage URL `https://maven.myket.ir`, add it to a **maven2 (group)**,
 > and point `MIRROR` at the group URL.
 
+## 💳 Payments — ZarinPal (web) vs store billing (Android)
+
+- **Web / PWA**: buying coins uses **ZarinPal** (sandbox now). Flow:
+  `POST /api/coins/pay/request` → redirect to `StartPay` → ZarinPal →
+  `GET /api/coins/pay/callback` (server verifies + credits) → back to the app
+  with `?pay=success`. Merchant id is config-driven (`Zarinpal:MerchantId`,
+  swap in the admin panel / appsettings; `Sandbox: true`).
+- **Cafe Bazaar / Myket (APK)**: app stores in Iran **require their own
+  in-app billing** — do NOT use ZarinPal inside the store build. Use:
+  - **Cafe Bazaar**: Poolakey (`ir.cafebazaar.poolakey`) — define in-app products in the Bazaar panel.
+  - **Myket**: Myket IAB SDK — define products in the Myket panel.
+  Wire a Capacitor plugin that detects the store build and routes `buyCoins`
+  to the store SDK; verify the purchase token on the server, then credit coins
+  via the same `ProfileService.BuyCoins`. (TODO — needs store accounts + product SKUs.)
+
 ## Release (Cafe Bazaar / Myket)
 1. Generate a keystore: `keytool -genkey -v -keystore bargevasat.keystore -alias bargevasat -keyalg RSA -keysize 2048 -validity 10000`
 2. Configure signing in `android/app/build.gradle` (release `signingConfig`).