feat(accounting): add Shayegan as fixed boursecu provider

Wire outbound Invoice/Document sync after confirmed ops, store sync status with timeout lock, and keep SQL credentials out of frontend responses.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Services/ConfigService.php

@@ -1261,6 +1261,7 @@ class ConfigService
     public const ACCOUNTING_TAHESAB = 'tahesab';
     public const ACCOUNTING_PARGAR = 'pargar';
     public const ACCOUNTING_ZARIN = 'zarin';
+    public const ACCOUNTING_SHAYEGAN = 'shayegan';
 
     public function isConditionalOrderEnabled(): bool
     {
@@ -1311,22 +1312,13 @@ class ConfigService
         return max(0, $this->getInt('fee_conditional_order', 0));
     }
 
-    /** none | tahesab | pargar | zarin — از setting accounting_provider */
+    /**
+     * بورس مس: حسابداری بیرونی همیشه شایگان است (مستقل از accounting_provider / legacy flags).
+     * ارسال واقعی فقط وقتی shayegan_* در settings کامل باشد (ShayeganSyncService::isSyncEnabled).
+     */
     public function accountingProvider(): string
     {
-        $provider = strtolower(trim($this->getString('accounting_provider', '')));
-        if (in_array($provider, [self::ACCOUNTING_NONE, self::ACCOUNTING_TAHESAB, self::ACCOUNTING_PARGAR, self::ACCOUNTING_ZARIN], true)) {
-            return $provider;
-        }
-
-        if ($this->getString('send_to_pargar', 'false') === 'true') {
-            return self::ACCOUNTING_PARGAR;
-        }
-        if ($this->getString('send_to_tahesab', 'false') === 'true') {
-            return self::ACCOUNTING_TAHESAB;
-        }
-
-        return self::ACCOUNTING_NONE;
+        return self::ACCOUNTING_SHAYEGAN;
     }
 
     public function isTahesabAccounting(): bool
@@ -1344,6 +1336,11 @@ class ConfigService
         return $this->accountingProvider() === self::ACCOUNTING_ZARIN;
     }
 
+    public function isShayeganAccounting(): bool
+    {
+        return $this->accountingProvider() === self::ACCOUNTING_SHAYEGAN;
+    }
+
     /**
      * Hostname for WebOTP SMS (@domain #code) and other public links.
      * Prefer settings.app_url (دامنهٔ اپ کاربر) over the API request host —