refactor: Remove ICurrentUserService dependency from query handlers and update user ID handling logic

src/CMSMicroservice.WebApi/Services/NetworkMembershipService.cs

@@ -8,6 +8,7 @@ using CMSMicroservice.Application.NetworkMembershipCQ.Queries.GetNetworkTree;
 using CMSMicroservice.Application.NetworkMembershipCQ.Queries.GetNetworkMembershipHistory;
 using CMSMicroservice.Application.NetworkMembershipCQ.Queries.GetNetworkStatistics;
 using CMSMicroservice.Application.NetworkMembershipCQ.Queries.GetMyNetworkTree;
+using CMSMicroservice.Application.Common.Interfaces;
 using Mapster;
 using CMSMicroservice.Domain.Enums;
 
@@ -17,13 +18,16 @@ public class NetworkMembershipService : NetworkMembershipContract.NetworkMembers
 {
     private readonly IDispatchRequestToCQRS _dispatchRequestToCQRS;
     private readonly ISender _sender;
+    private readonly ICurrentUserService _currentUserService;
 
     public NetworkMembershipService(
         IDispatchRequestToCQRS dispatchRequestToCQRS,
-        ISender sender)
+        ISender sender,
+        ICurrentUserService currentUserService)
     {
         _dispatchRequestToCQRS = dispatchRequestToCQRS;
         _sender = sender;
+        _currentUserService = currentUserService;
     }
 
     public override async Task<Empty> JoinNetwork(JoinNetworkRequest request, ServerCallContext context)
@@ -128,8 +132,11 @@ public class NetworkMembershipService : NetworkMembershipContract.NetworkMembers
 
     public override async Task<GetMyNetworkStatisticsResponse> GetMyNetworkStatistics(Google.Protobuf.WellKnownTypes.Empty request, ServerCallContext context)
     {
-        // Get statistics for current user's network
-        var query = new GetNetworkStatisticsQuery { UserId = 0 }; // Will use ICurrentUserService
+        // Customer endpoint: resolve userId from JWT
+        if (!long.TryParse(_currentUserService.UserId, out var userId) || userId <= 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
+        var query = new GetNetworkStatisticsQuery { UserId = userId };
         var stats = await _sender.Send(query, context.CancellationToken);
 
         return stats.Adapt<GetMyNetworkStatisticsResponse>();

src/CMSMicroservice.WebApi/Services/UserOrderService.cs

@@ -101,7 +101,7 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
         var query = new GetCustomerOrderQuery
         {
             OrderId = request.Id,
-            UserId = 0 // از JWT دریافت می‌شود
+            UserId = 0 // Admin: no user filter, can view any order by ID
         };
 
         var result = await _sender.Send(query, context.CancellationToken);
@@ -582,9 +582,14 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
     
     public override async Task<GetAllUserOrderByFilterResponse> GetCustomerOrders(GetAllUserOrderByFilterRequest request, ServerCallContext context)
     {
+        // Customer endpoint: ALWAYS resolve userId from JWT (customer can only see own orders)
+        var customerUserId = long.TryParse(_currentUserService.UserId, out var uid) ? uid : 0;
+        if (customerUserId == 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
         var query = new GetCustomerOrdersQuery
         {
-            UserId = request.Filter?.UserId ?? 0,
+            UserId = customerUserId,
             PaginationState = request.PaginationState?.Adapt<AppModels.PaginationState>(),
             PaymentStatusFilter = request.Filter?.PaymentStatus != null
                 ? (int?)request.Filter.PaymentStatus
@@ -652,10 +657,15 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
     
     public override async Task<GetUserOrderResponse> GetCustomerOrder(GetUserOrderRequest request, ServerCallContext context)
     {
+        // Customer endpoint: ALWAYS resolve userId from JWT (customer can only see own orders)
+        var customerUserId = long.TryParse(_currentUserService.UserId, out var uid) ? uid : 0;
+        if (customerUserId == 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
         var query = new GetCustomerOrderQuery
         {
             OrderId = request.Id,
-            UserId = 0 // از JWT دریافت می‌شود
+            UserId = customerUserId
         };
 
         var result = await _sender.Send(query, context.CancellationToken);

src/CMSMicroservice.WebApi/Services/UserWalletService.cs

@@ -57,8 +57,11 @@ public class UserWalletService : UserWalletContract.UserWalletContractBase
     
     public override async Task<GetCustomerWalletResponse> GetCustomerWallet(Google.Protobuf.WellKnownTypes.Empty request, ServerCallContext context)
     {
-        // Use GetUserWallet with Id=0 to automatically use current user from JWT
-        var walletQuery = new GetUserWalletQuery { Id = 0 };
+        // Customer endpoint: resolve userId from JWT
+        if (!long.TryParse(_currentUserService.UserId, out var userId) || userId <= 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
+        var walletQuery = new GetUserWalletQuery { Id = userId };
         var wallet = await _sender.Send(walletQuery, context.CancellationToken);
         
         return new GetCustomerWalletResponse