fix(paytr): encode hyphens in tenantId as Z in merchantOid

PayTR rejects merchant_oid with non-alphanumeric chars. Real Appwrite
tenant IDs are hex (a-z0-9) and safe, but demo-tenant-001 contains
hyphens. Encode - as Z (never appears in Appwrite hex IDs) in the
merchantOid; decode back in the callback.

src/app/api/payments/paytr/callback/route.ts

@@ -16,8 +16,9 @@ export async function POST(req: Request): Promise<Response> {
   }
 
   if (status === "success") {
-    // merchant_oid: {tenantId}T{timestamp}{random}P{plan}X{period}
-    const tenantId = merchantOid.split("T")[0];
+    // merchant_oid: {encodedTenantId}T{timestamp}{random}P{plan}X{period}
+    // Hyphens were encoded as Z — decode back
+    const tenantId = (merchantOid.split("T")[0] ?? "").replace(/Z/g, "-");
     const planPart = merchantOid.split("P")[1]; // "{plan}X{period}"
     const plan = (planPart?.split("X")[0] ?? "pro") as TenantPlan;
     const period = (planPart?.split("X")[1] ?? "monthly") as PlanPeriod;

src/lib/appwrite/subscription-actions.ts

@@ -213,9 +213,10 @@ export async function getPayTRTokenAction(formData: FormData): Promise<string> {
 
   const timestamp = Date.now().toString();
   const random = Math.random().toString(36).slice(2, 8);
-  // Uppercase harfler separator — tenantId (lowercase a-z0-9) hiçbir zaman içermez
-  // Format: {tenantId}T{timestamp}{random}P{plan}X{period}
-  const merchantOid = `${ctx.tenantId}T${timestamp}${random}P${planId}X${period}`;
+  // Hyphens encoded as Z (Appwrite hex IDs never contain uppercase letters)
+  // Format: {encodedTenantId}T{timestamp}{random}P{plan}X{period}
+  const encodedTenantId = ctx.tenantId.replace(/-/g, "Z");
+  const merchantOid = `${encodedTenantId}T${timestamp}${random}P${planId}X${period}`;
 
   const discountLabel = discountCodeRaw ? ` + ${discountCodeRaw.toUpperCase()} İndirimi` : "";
   const userBasket: Array<[string, string, number]> = [