feat: integrate PYMS payment gateway, add blog/sitepage/image services, local file manager

Payment Gateway:
- Add PYMSPaymentService: IPaymentGatewayService via gRPC to PYMS microservice
- Add ZarinPalPaymentService: direct ZarinPal integration (backup)
- Register 'pyms' payment provider in DI ConfigureServices
- Add PYMS proto files (pyms_transaction.proto, pyms_public_messages.proto)
- Fix VerifyDiscountWalletCharge: pass 'OK' as status instead of Authority
- Update appsettings: PaymentProvider=pyms, sandbox mode, merchant ID

Blog System:
- Add BlogCategory, BlogPost, BlogPostImage entities and CQRS
- Add proto files and gRPC services for blog management
- Add Mapster profiles for blog responses

Content Management:
- Add SitePage entity and CQRS for static pages
- Add proto and gRPC service for site pages

Image/File Management:
- Add LocalFileManager with disk storage + base64 serving + FMS fallback
- Add ImagePathResolverInterceptor for gRPC responses
- Add ImageResolverService for explicit image resolution
- Add UploadsController for public file serving with FMS fallback
- Add PaymentCallbackController for discount order payment callbacks

Database:
- Add blog and content entity migrations
- Remove ImagePath MaxLength constraints
- Remove old FileManagementService (replaced by LocalFileManager)

src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs

@@ -1,5 +1,4 @@
-using CMSMicroservice.Application.Common.Interfaces;
-using Microsoft.EntityFrameworkCore;
+using CMSMicroservice.Domain.Events;
 using Microsoft.Extensions.Configuration;
 
 namespace CMSMicroservice.Application.UserCQ.Commands.VerifyOtpToken;
@@ -19,36 +18,134 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         _cfg = cfg;
     }
 
+    const int MaxAttempts = 5;
+
     public async Task<VerifyOtpTokenResponseDto> Handle(VerifyOtpTokenCommand request, CancellationToken cancellationToken)
     {
+        var mobile = request.Mobile.NormalizeIranMobile();
+        var purpose = request.Purpose?.ToLowerInvariant() ?? "login";
+        var now = DateTime.Now;
+
         var otpToken = await _context.OtpTokens
-            .Where(x => x.Mobile == request.Mobile && x.Purpose == request.Purpose && !x.IsUsed)
+            .Where(x => x.Mobile == mobile && x.Purpose == purpose && !x.IsUsed && x.ExpiresAt > now)
             .OrderByDescending(x => x.Id)
             .FirstOrDefaultAsync(cancellationToken);
 
         if (otpToken == null)
-            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید نامعتبر است" };
+            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید منقضی شده یا وجود ندارد. لطفاً کد جدید دریافت کنید." };
 
-        // Check expiry and usage
-        if (otpToken.IsUsed || DateTime.Now > otpToken.ExpiresAt)
-            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید منقضی شده است" };
+        // بررسی تعداد تلاش
+        if (otpToken.Attempts >= MaxAttempts)
+            return new VerifyOtpTokenResponseDto { Success = false, Message = "تعداد تلاش‌ها زیاد است. لطفاً کد جدید دریافت کنید." };
 
-        // Verify using the same HMAC-SHA256 method used during creation
+        otpToken.Attempts++;
+
+        // Verify using HMAC-SHA256
         var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
         if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
-            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید نامعتبر است" };
+        {
+            await _context.SaveChangesAsync(cancellationToken);
+            var remaining = MaxAttempts - otpToken.Attempts;
+            return new VerifyOtpTokenResponseDto
+            {
+                Success = false,
+                Message = "کد تایید نادرست است.",
+                RemainingAttempts = remaining
+            };
+        }
 
+        // ── جستجوی کاربر ──
         var user = await _context.Users
             .Include(u => u.UserContracts)
                 .ThenInclude(uc => uc.Contract)
             .Include(u => u.UserRoles)
                 .ThenInclude(ur => ur.Role)
             .Include(u => u.ClubMembership)
-            .Where(x => x.Mobile == request.Mobile)
+            .Where(x => x.Mobile == mobile)
             .FirstOrDefaultAsync(cancellationToken);
 
+        // ── کاربر وجود ندارد → ثبت‌نام جدید ──
         if (user == null)
-            return new VerifyOtpTokenResponseDto { Success = false, Message = "کاربر یافت نشد" };
+        {
+            // کد معرف الزامی است
+            if (string.IsNullOrWhiteSpace(request.ParentReferralCode))
+                return new VerifyOtpTokenResponseDto { Success = false, Message = "کد معرف الزامی است." };
+
+            // بررسی وجود معرف و فعال بودن عضویت باشگاه
+            var parent = await _context.Users
+                .Include(u => u.ClubMembership)
+                .FirstOrDefaultAsync(u => u.ReferralCode == request.ParentReferralCode, cancellationToken);
+
+            if (parent == null)
+                return new VerifyOtpTokenResponseDto { Success = false, Message = "معرف وجود ندارد." };
+
+            if (parent.ClubMembership == null || !parent.ClubMembership.IsActive)
+                return new VerifyOtpTokenResponseDto
+                {
+                    Success = false,
+                    Message = "لینک دعوت معرف فعال نیست. لطفاً از کد دعوت معتبر دیگری استفاده کنید."
+                };
+
+            // بررسی ظرفیت معرف (حداکثر ۲ زیرمجموعه مستقیم)
+            var existingChildren = await _context.Users
+                .Where(x => x.NetworkParentId == parent.Id && !x.IsDeleted)
+                .Select(x => x.LegPosition)
+                .ToListAsync(cancellationToken);
+
+            if (existingChildren.Count > 1)
+                return new VerifyOtpTokenResponseDto { Success = false, Message = "ظرفیت معرف تکمیل است!!" };
+
+            // تعیین موقعیت شاخه (چپ اول، بعد راست)
+            NetworkLeg newUserLegPosition;
+            if (!existingChildren.Any(x => x == NetworkLeg.Left))
+                newUserLegPosition = NetworkLeg.Left;
+            else if (!existingChildren.Any(x => x == NetworkLeg.Right))
+                newUserLegPosition = NetworkLeg.Right;
+            else
+                return new VerifyOtpTokenResponseDto { Success = false, Message = "ظرفیت معرف تکمیل است!!" };
+
+            // ایجاد کاربر جدید
+            user = new User
+            {
+                Mobile = mobile,
+                ReferralCode = UtilExtensions.Generate(digits: 10, firstDigitNonZero: true),
+                IsMobileVerified = true,
+                MobileVerifiedAt = now,
+                IsRulesAccepted = true,
+                RulesAcceptedAt = now,
+                NetworkParentId = parent.Id,
+                LegPosition = newUserLegPosition
+            };
+            await _context.Users.AddAsync(user, cancellationToken);
+            user.AddDomainEvent(new CreateNewUserEvent(user));
+            await _context.SaveChangesAsync(cancellationToken);
+
+            // ایجاد نقش کاربری
+            var userRole = new UserRole { UserId = user.Id, RoleId = 1 };
+            await _context.UserRoles.AddAsync(userRole, cancellationToken);
+            user.AddDomainEvent(new CreateNewUserRoleEvent(userRole));
+
+            // ایجاد کیف پول
+            var userWallet = new UserWallet { UserId = user.Id, Balance = 0, NetworkBalance = 0 };
+            await _context.UserWallets.AddAsync(userWallet, cancellationToken);
+            user.AddDomainEvent(new CreateNewUserWalletEvent(userWallet));
+            await _context.SaveChangesAsync(cancellationToken);
+
+            // بارگذاری مجدد کاربر با روابط کامل (برای تولید توکن)
+            user = await _context.Users
+                .Include(u => u.UserContracts)
+                    .ThenInclude(uc => uc.Contract)
+                .Include(u => u.UserRoles)
+                    .ThenInclude(ur => ur.Role)
+                .Include(u => u.ClubMembership)
+                .FirstAsync(x => x.Id == user.Id, cancellationToken);
+        }
+        else
+        {
+            // کاربر موجود — به‌روزرسانی وضعیت تایید موبایل
+            user.IsMobileVerified = true;
+            user.MobileVerifiedAt ??= now;
+        }
 
         // Mark OTP as used
         otpToken.IsUsed = true;
@@ -61,7 +158,8 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         { 
             Success = true, 
             Message = "کد تایید با موفقیت تایید شد",
-            Token = token
+            Token = token,
+            RemainingAttempts = MaxAttempts
         };
     }
 }