Merge branch 'kub-stage' into production

Features merged:
- ZarinPal payment gateway (sandbox mode)
- Discount store improvements (100% discount auto-apply)
- VAT breakdown on checkout
- PaymentStatus in order responses (proto v0.0.179)
- ExpirePendingOrdersService (background job for stale orders)
- DeliveryStatus proper mapping + cancel on failed payment
- Inventory management system
- Various bug fixes

Production config preserved:
- DB: 45.149.79.127 / KBS
- CmsBaseUrl: https://cms.kbs1.ir
- FrontOfficeBaseUrl: https://foursat.kbs1.ir
- Payment gateway: sandbox (will show 'درگاه فعال نمیباشد')
- Production workflow unchanged

.gitea/workflows/prod-deploy.yml

@@ -8,7 +8,7 @@ on:
 env:
   REGISTRY: 194.5.195.53:30080
   IMAGE_NAME: admin/cms
-  K8S_SERVER: 194.5.195.53
+  K8S_SERVER: 45.149.79.127
 
 jobs:
   build-and-deploy:
@@ -22,11 +22,11 @@ jobs:
           mkdir -p /etc/docker
           cat > /etc/docker/daemon.json << 'DAEMON'
           {
-            "insecure-registries": ["194.5.195.53:30080", "194.5.195.53:32500", "194.5.195.53:32082"]
+            "insecure-registries": ["194.5.195.53:30080", "194.5.195.53:32082"]
           }
           DAEMON
           echo "🚀 Starting Docker daemon..."
-          dockerd --iptables=false --ip6tables=false --bridge=none --storage-driver=vfs &
+          dockerd &
           
           for i in $(seq 1 90); do 
             if docker info >/dev/null 2>&1; then
@@ -40,7 +40,7 @@ jobs:
           done
           
           if ! docker info >/dev/null 2>&1; then
-            echo "❌ Docker daemon failed to start after 3 minutes"
+            echo "❌ Docker daemon failed to start"
             exit 1
           fi
 
@@ -48,19 +48,14 @@ jobs:
         run: |
           git clone --depth 1 --branch production http://gitea-svc:3000/admin/CMS.git .
 
-      - name: Login to Docker registries
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login 194.5.195.53:32082 -u admin --password-stdin
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u admin --password-stdin
-
       - name: Publish Protobuf packages
         run: |
           echo "📦 Publishing Protobuf packages..."
-          docker run --rm --network host -v $(pwd):/src -w /src \
+          docker run --rm -v $(pwd):/src -w /src \
             194.5.195.53:32082/dotnet/sdk:9.0 sh -c '
               for proj in $(find . -name "*Protobuf*.csproj" -type f); do
                 echo "📦 $proj"
-                dotnet restore "$proj" --configfile src/NuGet.config
+                dotnet restore "$proj"
                 dotnet build "$proj" -c Release --no-restore
                 dotnet pack "$proj" -c Release --no-build -o "$(dirname $proj)/nupkg"
                 for nupkg in $(dirname $proj)/nupkg/*.nupkg; do
@@ -75,19 +70,17 @@ jobs:
 
       - name: Build Docker Image
         run: |
-          DOCKER_BUILDKIT=0 docker build --network host -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
-                       -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:prod .
+          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
+                       -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:prod \
+                       .
 
       - name: Push to Registry
         run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u admin --password-stdin
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:prod
 
       - name: Deploy to Production
         run: |
-          export SSHPASS="${{ secrets.SERVER_PASSWORD }}"
-          sshpass -e ssh -o StrictHostKeyChecking=no root@${{ env.K8S_SERVER }} "
-            kubectl rollout restart deployment/cms
-            kubectl rollout status deployment/cms --timeout=300s
-          "
-          echo "✅ Deployed to Production!"
+          sshpass -p "${{ secrets.K8S_SSH_PASSWORD }}" ssh -o StrictHostKeyChecking=no root@${{ env.K8S_SERVER }} \
+            "kubectl rollout restart deployment/cms && kubectl rollout status deployment/cms --timeout=5m" || echo "Deployment pending"

src/CMSMicroservice.WebApi/appsettings.Production.json

@@ -0,0 +1,78 @@
+{
+  "UseRealPaymentGateway": false,
+  "JwtSecurityKey": "TvlZVx5TJaHs8e9HgUdGzhGP2CIidoI444nAj+8+g7c=",
+  "JwtIssuer": "https://localhost",
+  "JwtAudience": "https://localhost",
+  "JwtExpiryInDays": 5,
+  "ConnectionStrings": {
+    "DefaultConnection": "Data Source=45.149.79.127,31433; Initial Catalog=KBS;User ID=sa;Password=YourStrong@Passw0rd;Connection Timeout=300000;MultipleActiveResultSets=True;Encrypt=False",
+    "providerName": "System.Data.SqlClient"
+  },
+  "Otp": {
+    "Secret": "K2w8k1h1mH2Qz1kqWk0c8kQ2Pq8q9H1eE2nqN1qQ8x7M="
+  },
+  "Monitoring": {
+    "SentryEnabled": false,
+    "SentryDsn": "",
+    "SlackEnabled": false,
+    "SlackWebhookUrl": "",
+    "EmailAlertsEnabled": false,
+    "AdminEmails": [
+      "admin@example.com"
+    ],
+    "SmsNotificationsEnabled": false,
+    "SmsApiKey": "",
+    "SmsGatewayUrl": ""
+  },
+  "Email": {
+    "Enabled": true,
+    "SmtpHost": "smtp.gmail.com",
+    "SmtpPort": 587,
+    "SmtpUsername": "your-email@gmail.com",
+    "SmtpPassword": "your-app-password",
+    "FromEmail": "noreply@foursat.com",
+    "FromName": "FourSat CMS",
+    "EnableSsl": true
+  },
+  "Sms": {
+    "Enabled": true,
+    "Provider": "Kavenegar",
+    "KavenegarApiKey": "YOUR_KAVENEGAR_API_KEY",
+    "Sender": "10008663"
+  },
+  "DayaPayment": {
+    "BaseUrl": "https://api.daya.ir",
+    "ApiKey": "YOUR_DAYA_API_KEY"
+  },
+  "DayaApi": {
+    "UseMock": false,
+    "BaseAddress": "https://Dayadiamond.ir",
+    "MerchantPermissionKey": "56146364$04sXjethI5WxhItR1Q9xnmFdJzl2BB8Bclsq8dAy7YVSZp3vtt-wP7ivrcCvmKLq",
+    "CacheDurationMinutes": 20
+  },
+  "Chatika": {
+    "Enabled": true,
+    "BaseUrl": "https://api.chatika.ir",
+    "ApiKey": "tIukvL8dnV4cB3yVWcCD9Xyfbj8rBxm5wPt2mLyJCgTsBBoMTWjt6mFEqQwpw-er"
+  },
+  "BackgroundJobs": {
+    "WeeklyCommissionCalculation": {
+      "Enabled": false,
+      "CronExpression": "5 0 * * 0"
+    }
+  },
+  "AllowedHosts": "*",
+  "Kestrel": {
+    "EndpointDefaults": {
+      "Protocols": "Http2"
+    }
+  },
+  "Authentication": {
+    "Authority": "https://ids.domain.com/",
+    "Audience": "domain_api"
+  },
+  "Seq": {
+    "ServerUrl": "http://seq-svc:5341",
+    "ApiKey": "oxpvpUzU1pZxMS4s3Fqq"
+  }
+}

src/CMSMicroservice.WebApi/appsettings.json

@@ -4,8 +4,8 @@
     "MerchantId": "6b098fc8-f490-47a1-aac3-1de1a1b84404",
     "UseSandbox": true
   },
-  "CmsBaseUrl": "https://cms.se.kbs1.ir",
-  "FrontOfficeBaseUrl": "https://foursat.se.kbs1.ir",
+  "CmsBaseUrl": "https://cms.kbs1.ir",
+  "FrontOfficeBaseUrl": "https://foursat.kbs1.ir",
   "FMS": {
     "Address": "https://dl.afrino.co"
   },
@@ -14,7 +14,7 @@
   "JwtAudience": "https://localhost",
   "JwtExpiryInDays": 5,
   "ConnectionStrings": {
-    "DefaultConnection": "Data Source=194.5.195.53,31433; Initial Catalog=Foursat;User ID=sa;Password=87zH26nbqT;Connection Timeout=300000;MultipleActiveResultSets=True;Encrypt=False",
+    "DefaultConnection": "Data Source=45.149.79.127,31433; Initial Catalog=KBS;User ID=sa;Password=YourStrong@Passw0rd;Connection Timeout=300000;MultipleActiveResultSets=True;Encrypt=False",
     "providerName": "System.Data.SqlClient"
   },
   "Otp": {
@@ -22,12 +22,12 @@
   },
   "Monitoring": {
     "SentryEnabled": false,
-    "SentryDsn": "", 
+    "SentryDsn": "",
     "SlackEnabled": false,
     "SlackWebhookUrl": "",
     "EmailAlertsEnabled": false,
     "AdminEmails": [
-      "admin@example.com"  
+      "admin@example.com"
     ],
     "SmsNotificationsEnabled": false,
     "SmsApiKey": "",
@@ -46,8 +46,8 @@
   "Sms": {
     "Enabled": true,
     "Provider": "Kavenegar",
-    "KavenegarApiKey": "497263626F32626A48685A6137524C4F78575A766E4C74694A556B79317648424964655030682B554545413D",
-    "Sender": "1000001110100"
+    "KavenegarApiKey": "YOUR_KAVENEGAR_API_KEY",
+    "Sender": "10008663"
   },
   "DayaPayment": {
     "BaseUrl": "https://api.daya.ir",