fix(payments): apply request timeout changes without restart

PAYMENT_REQUEST_TIMEOUT_SECONDS was read once in each provider's
__init__ and baked into the aiohttp session, so admin overrides
(applied in-process) only took effect after a container restart.
Providers now hand HttpClientMixin a timeout source callable; the
mixin builds the session with the current value and swaps in a fresh
session when the value changes, closing the replaced one only after
any in-flight request on it is bound by its own total timeout.

Also:
- check the Heleket payment-info success flag before reading the
  payload so a non-dict provider response cannot raise in the
  pending-payment reuse path
- add PAYMENT_REQUEST_TIMEOUT_SECONDS to the FreeKassa settings stub
  in test_security.py (fixes three tests broken by the new field)

backend/bot/payment_providers/heleket.py

@@ -246,7 +246,7 @@ class HeleketService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "HeleketService initialized but not fully configured. Payments disabled."
@@ -418,8 +418,10 @@ class HeleketService(HttpClientMixin):
             return None
 
         success, data = await self.get_payment_info(payment_uuid)
+        if not success or not isinstance(data, dict):
+            return None
         status = str(data.get("payment_status") or data.get("status") or "").lower()
-        if not success or status != "check" or bool(data.get("is_final")):
+        if status != "check" or bool(data.get("is_final")):
             return None
         if str(data.get("uuid") or "") != payment_uuid:
             return None