feat(payment): admin-editable ZarinPal settings + in-panel test payment

Lets the broker's ZarinPal merchant / sandbox / amount-unit be set from
Admin → درگاه پرداخت (persisted in payment.settings) instead of env +
redeploy, and adds a per-app "test payment" button that mints a real
ZarinPal StartPay link straight from the panel — no site wiring needed.

- migration 33_payment_settings.sql: singleton payment.settings + a
  transactions.is_test column. (33, not 32 — 32 is content_render_engine.)
- broker read-path precedence: per-client override > DB settings > env.
- POST /v1/admin/clients/:id/test-payment + GET/PUT /v1/admin/settings.
- admin UI: «تنظیمات زرین‌پال» tab + «پرداخت آزمایشی» button.

Adversarial-review fixes (2 confirmed HIGH):
- do NOT pre-seed the settings row — a seeded sandbox=TRUE default would
  override a production ZARINPAL_SANDBOX=false env and silently route real
  payments to sandbox.zarinpal.com until an admin untouched the toggle.
  No row → env governs until an admin saves.
- test transactions are tagged is_test and the webhook dispatcher skips
  them, so an admin smoke-test can never notify (or credit) a real client,
  regardless of metadata. Broker-authoritative, not consumer-dependent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -63,3 +63,5 @@ services/remotion/out/
 # local scratch / agent work
 /-w
 /.agent-work/
+dist/
+services/remotion/player-dist/

backend/db/migrations/33_payment_settings.sql

@@ -0,0 +1,35 @@
+-- =====================================================================
+-- PAYMENT BROKER — global settings (admin-editable ZarinPal config) + is_test
+-- Lets the merchant id / sandbox flag / amount unit be set from the admin
+-- panel instead of env + redeploy. A client_app may still override per-site.
+-- Also adds transactions.is_test so admin smoke-test payments never fire a
+-- client's production webhook.
+--
+-- Apply manually on an existing volume (runs after 31_payment_broker.sql):
+--   docker exec -i fr2-postgres psql -U flatrender -d flatrender < 33_payment_settings.sql
+-- =====================================================================
+
+CREATE SCHEMA IF NOT EXISTS payment;
+SET search_path TO payment, public;
+
+CREATE TABLE IF NOT EXISTS payment.settings (
+    id                    SMALLINT PRIMARY KEY DEFAULT 1 CHECK (id = 1),  -- singleton row
+    zarinpal_merchant_id  TEXT NOT NULL DEFAULT '',
+    zarinpal_sandbox      BOOLEAN NOT NULL DEFAULT TRUE,
+    zarinpal_amount_unit  TEXT NOT NULL DEFAULT 'rial',   -- 'rial' | 'toman'
+    updated_at            TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- NOTE: the singleton row is intentionally NOT pre-seeded. Until an admin saves
+-- settings, GetSettings returns no-row and the broker falls back to ENV
+-- (ZARINPAL_MERCHANT_ID / ZARINPAL_SANDBOX / ZARINPAL_AMOUNT_UNIT). Seeding a
+-- default row here would force sandbox=TRUE and silently override a production
+-- env (ZARINPAL_SANDBOX=false), routing real payments to the sandbox gateway.
+
+DROP TRIGGER IF EXISTS tg_pay_settings_updated ON payment.settings;
+CREATE TRIGGER tg_pay_settings_updated BEFORE UPDATE ON payment.settings
+    FOR EACH ROW EXECUTE FUNCTION public.tg_set_updated_at();
+
+-- Mark admin smoke-test transactions so the webhook dispatcher never notifies a
+-- real client (which could otherwise credit coins/activate a plan from a test).
+ALTER TABLE payment.transactions ADD COLUMN IF NOT EXISTS is_test BOOLEAN NOT NULL DEFAULT FALSE;

deploy/README.md

@@ -23,9 +23,14 @@ ZarinPal gateway shared by FlatRender + meezi.ir + bargevasat.ir — ZarinPal on
 accepts callbacks on that one verified domain. It does NOT sit behind the API
 gateway (clients authenticate with an API key + HMAC). See
 [`PAYMENTS.md`](./PAYMENTS.md) for the integration contract. The `payment` schema
-is migration `31_payment_broker.sql` — on an existing DB volume it must be applied
+is migrations `31_payment_broker.sql` (tables) + `33_payment_settings.sql`
-manually (migrations only auto-run on first volume creation):
+(admin-editable ZarinPal config + `transactions.is_test`) — apply BOTH, in order,
-`docker exec -i fr2-postgres psql -U postgres -d flatrender < backend/db/migrations/31_payment_broker.sql`.
+on an existing DB volume (migrations only auto-run on first volume creation):
+```
+docker exec -i fr2-postgres psql -U flatrender -d flatrender < backend/db/migrations/31_payment_broker.sql
+docker exec -i fr2-postgres psql -U flatrender -d flatrender < backend/db/migrations/33_payment_settings.sql
+```
+The broker image expects `is_test` (migration 33) — deploy it together with both migrations.
 
 ## One-time setup (do these BEFORE the first `git push gitea master`)
 

docker-compose.v2.yml

@@ -88,6 +88,9 @@ services:
       Jwt__Audience: "flatrender"
       Jwt__AccessTokenMinutes: "${JWT_ACCESS_MINUTES:-1440}"
       ServiceToken: "${SERVICE_TOKEN:-internal-service-secret}"
+      # Payment callbacks land on this service (api.*); the result page is on the
+      # frontend. Used to make /payment/result redirects absolute to the site.
+      Frontend__BaseUrl: "${NEXT_PUBLIC_SITE_URL:-http://localhost:3000}"
       ZarinPal__MerchantId:   "${ZARINPAL_MERCHANT_ID:-}"
       ZarinPal__CallbackUrl:  "${ZARINPAL_CALLBACK_URL:-http://localhost:8080/v1/payments/callback/zarinpal}"
       ZarinPal__Sandbox:      "${ZARINPAL_SANDBOX:-true}"

messages/en.json

@@ -1148,8 +1148,13 @@
       "description": "Generate voiceovers from your script directly in the studio."
     },
     "componentsStudioSidebarColorsCustomTab": {
-      "mainColor": "Main Color",
+      "mainColor": "Background",
-      "additionalColor": "Additional Color",
+      "additionalColor": "Accent",
+      "secondaryColor": "Secondary",
+      "textColor": "Text",
+      "themePresets": "Themes",
+      "applyThemePreset": "Apply {name} theme",
+      "applyTheme": "Apply theme",
       "applyToAllScenes": "Apply to all scenes"
     },
     "componentsStudioSidebarColorsPalettesTab": {
@@ -1184,6 +1189,14 @@
       "replaceImage": "Replace image",
       "uploadImage": "Upload image"
     },
+    "componentsStudioSidebarBlockFieldForm": {
+      "panelTitle": "Edit Scene",
+      "emptyState": "This scene has no editable fields.",
+      "fieldFallback": "Field {index}",
+      "textPlaceholder": "Type here…",
+      "replaceImage": "Replace image",
+      "uploadImage": "Upload image"
+    },
     "componentsStudioSidebarTransitionsSidebarContent": {
       "heading": "Transitions",
       "randomTransition": "Random Transition",
@@ -1224,7 +1237,10 @@
       "deleteScene": "Delete {name}",
       "resizeSceneDuration": "Resize {name} duration",
       "sceneNameLabel": "Scene name",
-      "doubleClickToRename": "Double-click to rename"
+      "doubleClickToRename": "Double-click to rename",
+      "reorderScene": "Reorder {name}",
+      "durationLabel": "Scene duration (seconds)",
+      "secondsUnit": "s"
     },
     "componentsStudioTimelineSceneThumbnailStrip": {
       "browseScenes": "Browse scenes",

messages/fa.json

@@ -1148,8 +1148,13 @@
       "description": "صداگذاری را مستقیماً از روی متن خود در استودیو بسازید."
     },
     "componentsStudioSidebarColorsCustomTab": {
-      "mainColor": "رنگ اصلی",
+      "mainColor": "پس‌زمینه",
-      "additionalColor": "رنگ مکمل",
+      "additionalColor": "رنگ اصلی",
+      "secondaryColor": "رنگ دوم",
+      "textColor": "رنگ متن",
+      "themePresets": "تم‌ها",
+      "applyThemePreset": "اعمال تم {name}",
+      "applyTheme": "اعمال تم",
       "applyToAllScenes": "اعمال به همه صحنه‌ها"
     },
     "componentsStudioSidebarColorsPalettesTab": {
@@ -1184,6 +1189,14 @@
       "replaceImage": "جایگزینی تصویر",
       "uploadImage": "بارگذاری تصویر"
     },
+    "componentsStudioSidebarBlockFieldForm": {
+      "panelTitle": "ویرایش صحنه",
+      "emptyState": "این صحنه فیلد قابل‌ویرایشی ندارد.",
+      "fieldFallback": "فیلد {index}",
+      "textPlaceholder": "اینجا بنویسید…",
+      "replaceImage": "جایگزینی تصویر",
+      "uploadImage": "بارگذاری تصویر"
+    },
     "componentsStudioSidebarTransitionsSidebarContent": {
       "heading": "ترانزیشن‌ها",
       "randomTransition": "ترانزیشن تصادفی",
@@ -1224,7 +1237,10 @@
       "deleteScene": "حذف {name}",
       "resizeSceneDuration": "تغییر مدت زمان {name}",
       "sceneNameLabel": "نام صحنه",
-      "doubleClickToRename": "برای تغییر نام، دوبار کلیک کنید"
+      "doubleClickToRename": "برای تغییر نام، دوبار کلیک کنید",
+      "reorderScene": "جابه‌جایی {name}",
+      "durationLabel": "مدت صحنه (ثانیه)",
+      "secondsUnit": "ث"
     },
     "componentsStudioTimelineSceneThumbnailStrip": {
       "browseScenes": "مرور صحنه‌ها",