feat(payment): unify payment flow with new pure redirect entry and update related endpoints

src/Shared/EventSubscriber/SecurityHeadersSubscriber.php

@@ -27,7 +27,23 @@ class SecurityHeadersSubscriber implements EventSubscriberInterface
 
         $path = $event->getRequest()->getPathInfo();
         if (str_starts_with($path, '/api') && !str_starts_with($path, '/api/doc')) {
-            $response->headers->set('Content-Security-Policy', "default-src 'none'");
+            // صفحات مرورگرمحورِ پرداخت (order/pay/callback) HTML برمی‌گردانند و به
+            // inline style + فونت + فرمِ انتقال به شاپرک نیاز دارند؛ بقیهٔ API (JSON)
+            // همان سیاست سخت‌گیرانه را می‌گیرد.
+            $isPaymentPage =
+                str_starts_with($path, '/api/v1/payment/order/')
+                || str_starts_with($path, '/api/v1/payment/pay/')
+                || str_starts_with($path, '/api/v1/payment/callback/')
+                || str_starts_with($path, '/api/v1/subscription-payment/callback/');
+
+            $response->headers->set(
+                'Content-Security-Policy',
+                $isPaymentPage
+                    ? "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; "
+                        . "font-src https://cdn.jsdelivr.net data:; img-src data:; "
+                        . "form-action https://*.shaparak.ir; base-uri 'none'"
+                    : "default-src 'none'"
+            );
         }
 
         if (str_starts_with($path, '/admin') || str_starts_with($path, '/api')) {