feat(payment): standalone ZarinPal broker on pay.flatrender.ir

A generic multi-client payment gateway so FlatRender, meezi.ir and
bargevasat.ir can all pay through ZarinPal's single verified callback
domain (pay.flatrender.ir).

New Go service services/payment (clones the notification skeleton +
vendored deps):
- migration 31_payment_broker.sql — `payment` schema: client_apps,
  transactions, webhook_deliveries.
- ZarinPal v4 client ported from the proven identity PaymentService
  (request.json -> StartPay -> verify.json; codes 100/101).
- client API: POST /v1/pay/request + /v1/pay/inquiry, authed by
  X-Api-Key + HMAC body signature; GET /callback/zarinpal (the single
  verified endpoint) verifies, then 302s the user back to the site's
  return_url (signed) and fires a signed, retried webhook.
- per-client ZarinPal merchant override (default = shared merchant);
  amount stored canonically in Rial, unit to ZarinPal env-configurable.
- admin API /v1/admin/* (FlatRender admin JWT): client-app CRUD +
  key issue/rotate + transactions list.

Deploy wiring: payment-svc in docker-compose.v2.yml (host port 1607),
pay.flatrender.ir server block in mirror-nginx conf, ENV_FILE +
README updates (cert SAN + manual migration note).

Admin UI: src/components/admin/PaymentsAdmin.tsx (client apps with
one-time key reveal + rotate, transactions table) + /admin/payments
page + nav link + fa/en strings; pay-admin proxy route to payment-svc.

Docs/SDK: deploy/PAYMENTS.md (integration contract) + deploy/sdk/flatpay.js
(zero-dep Node client + webhook verifier) for meezi/any site.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.v2.yml

@@ -255,6 +255,41 @@ services:
       retries: 5
       start_period: 10s
 
+  # ── Payment Broker (Go) — pay.flatrender.ir ─────────────────────────────────
+  # Standalone generic ZarinPal gateway. Other sites (meezi, bargevasat) and
+  # FlatRender register as client_apps and route payments through it, because
+  # ZarinPal only accepts callbacks on the single verified domain pay.flatrender.ir.
+  # Exposed on its OWN host port (mirror-nginx → pay.flatrender.ir → here);
+  # it does NOT sit behind the API gateway (clients auth with API key + HMAC).
+
+  payment-svc:
+    build:
+      context: ./services/payment
+    container_name: fr2-payment
+    restart: unless-stopped
+    ports:
+      - "${EDGE_BIND:-0.0.0.0}:${PAY_PORT:-8090}:8080"
+    environment:
+      DATABASE_URL: "postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/flatrender?search_path=payment,public"
+      JWT_SECRET: "${JWT_SECRET}"
+      PORT: "8080"
+      # Externally reachable base — ZarinPal callback + user redirect are built from it.
+      PUBLIC_BASE_URL: "${PAY_PUBLIC_URL:-http://localhost:8090}"
+      # Shared default ZarinPal merchant (a client_app may override per-site).
+      ZARINPAL_MERCHANT_ID: "${ZARINPAL_MERCHANT_ID:-}"
+      ZARINPAL_SANDBOX: "${ZARINPAL_SANDBOX:-true}"
+      # Unit ZarinPal expects in the amount field: "rial" (official v4) or "toman".
+      ZARINPAL_AMOUNT_UNIT: "${ZARINPAL_AMOUNT_UNIT:-rial}"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
   # ── API Gateway (Go) ────────────────────────────────────────────────────────
 
   gateway:
@@ -318,6 +353,8 @@ services:
       HOSTNAME: "0.0.0.0"
       # Server-side: Next route handlers reach the gateway over the internal network.
       API_GATEWAY_URL: "http://gateway:8080"
+      # Admin proxy reaches the payment broker directly (not via the gateway).
+      PAYMENT_SVC_URL: "http://payment-svc:8080"
     depends_on:
       gateway:
         condition: service_healthy