fix: separate HWID device renewal flows

Keep one-off device top-ups scoped to the active subscription term and move device renewal into subscription checkout.

Carry HWID renewal metadata through provider callbacks and webhooks, including YooKassa saved-card flows.

Add admin extension controls, docs, demo data, and regression coverage.

tests/test_webapp_payment_status.py

@@ -164,7 +164,7 @@ class WebAppPaymentStatusTests(IsolatedAsyncioTestCase):
         ):
             response = await billing_module.payment_status_route(request)
 
-        invalidate_cache.assert_awaited_once_with(settings, 1001)
+        invalidate_cache.assert_awaited_once_with(settings, 1001, include_devices=True)
         self.assertEqual(response.status, 200)
 
     async def test_wata_pending_payment_refresh_delegates_to_provider_service(self):