fix(payments): apply request timeout changes without restart

PAYMENT_REQUEST_TIMEOUT_SECONDS was read once in each provider's
__init__ and baked into the aiohttp session, so admin overrides
(applied in-process) only took effect after a container restart.
Providers now hand HttpClientMixin a timeout source callable; the
mixin builds the session with the current value and swaps in a fresh
session when the value changes, closing the replaced one only after
any in-flight request on it is bound by its own total timeout.

Also:
- check the Heleket payment-info success flag before reading the
  payload so a non-dict provider response cannot raise in the
  pending-payment reuse path
- add PAYMENT_REQUEST_TIMEOUT_SECONDS to the FreeKassa settings stub
  in test_security.py (fixes three tests broken by the new field)

tests/test_security.py

@@ -181,6 +181,7 @@ class FreeKassaServiceTests(unittest.TestCase):
 
         settings = SimpleNamespace(
             DEFAULT_CURRENCY_SYMBOL="RUB",
+            PAYMENT_REQUEST_TIMEOUT_SECONDS=15,
             trusted_proxies=["127.0.0.1"],
         )
         config = FreeKassaConfig(