fix(prod): payment/tax gateways never fake success outside Development

Production-readiness audit fixes — every mock fallback is now gated on
IsDevelopment; in production these paths fail loudly instead:

- ZarinPal/Tara/SnappPay init: missing credentials returned a MOCK
  payment URL whose callback verified as paid — a café could activate a
  paid plan without paying. Now: "Payment gateway is not configured."
- Tara/SnappPay verify: a forged MOCK-* trace/token on the callback was
  accepted as a verified payment in any environment. Now rejected
  outside Development.
- Taraz (سامانه مودیان): returned a fake MOCK-TARAZ tracking code as if
  invoices reached the tax authority. Now returns an honest error (the
  real integration is not built yet).
- Admin integrations: NextPay/Vandar removed — they were listed but have
  no gateway implementation (selecting them silently used ZarinPal).
- docker-compose: ASPNETCORE_ENVIRONMENT default flipped Development →
  Production so a missing env var can never run prod in dev mode.

86 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Meezi.Infrastructure/ExternalServices/ZarinPalGateway.cs

@@ -2,6 +2,7 @@ using System.Net.Http.Json;
 using System.Text.Json.Serialization;
 using Meezi.Core.Interfaces;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 
 namespace Meezi.Infrastructure.ExternalServices;
@@ -17,17 +18,20 @@ public class ZarinPalGateway : IZarinPalGateway
     private readonly HttpClient _httpClient;
     private readonly IConfiguration _configuration;
     private readonly IPlatformRuntimeConfig _platform;
+    private readonly IHostEnvironment _environment;
     private readonly ILogger<ZarinPalGateway> _logger;
 
     public ZarinPalGateway(
         HttpClient httpClient,
         IConfiguration configuration,
         IPlatformRuntimeConfig platform,
+        IHostEnvironment environment,
         ILogger<ZarinPalGateway> logger)
     {
         _httpClient = httpClient;
         _configuration = configuration;
         _platform = platform;
+        _environment = environment;
         _logger = logger;
     }
 
@@ -40,6 +44,15 @@ public class ZarinPalGateway : IZarinPalGateway
         var merchantId = await GetMerchantIdAsync(cancellationToken);
         if (string.IsNullOrWhiteSpace(merchantId))
         {
+            // Mock checkout exists ONLY for local development. In production a
+            // missing merchant id must fail loudly — a fake-success here would
+            // activate paid plans without any real payment.
+            if (!_environment.IsDevelopment())
+            {
+                _logger.LogError("ZarinPal merchant id missing — refusing payment init in {Env}", _environment.EnvironmentName);
+                return new ZarinPalRequestResult(false, null, null, "Payment gateway is not configured.");
+            }
+
             var mockAuthority = Guid.NewGuid().ToString("N")[..16];
             var mockUrl = $"{callbackUrl}?Authority={mockAuthority}&Status=OK";
             _logger.LogInformation("ZarinPal mock payment {Authority} amount {Amount} Rials", mockAuthority, amountRials);
@@ -81,6 +94,11 @@ public class ZarinPalGateway : IZarinPalGateway
         var merchantId = await GetMerchantIdAsync(cancellationToken);
         if (string.IsNullOrWhiteSpace(merchantId))
         {
+            if (!_environment.IsDevelopment())
+            {
+                _logger.LogError("ZarinPal merchant id missing — refusing payment verify in {Env}", _environment.EnvironmentName);
+                return new ZarinPalVerifyResult(false, null, "Payment gateway is not configured.");
+            }
             _logger.LogInformation("ZarinPal mock verify authority {Authority}", authority);
             return new ZarinPalVerifyResult(true, "MOCK-" + authority[..8], null);
         }