fix(cabinet): recover "Сервис недоступен" false-positive + top-up fixes

- health probe: tolerant timeout (12s) + retry before flagging the backend down. A
  hardcoded 5s probe racing auth bootstrap falsely showed ServiceUnavailableScreen on
  slow devices / cold mobile connections while the 30s API requests would have
  succeeded ("works on one device, not another on the same Wi-Fi"). The recovery poll
  self-reschedules with the tolerant timeout so slow devices auto-recover.
- TopUpAmount: fetch payment methods with a real query (fixes the infinite spinner on a
  cold cache / browser-back) and use canonical RUB for quick-amount chips so FX rounding
  can't reject a min-amount selection in non-RUB locales.
- settings UI: render secret values as a masked password input (pairs with the backend
  secret masking); leaving the field empty keeps the stored secret.
- deps: npm audit fix (18 -> 5 advisories).

Also bundles in-progress settings env-lock UI work.

src/config/constants.ts

@@ -29,3 +29,17 @@ export const API = {
   TRAFFIC_WARN_PERCENT: 70,
   TRAFFIC_CRITICAL_PERCENT: 90,
 } as const;
+
+// Backend liveness probe (ServiceUnavailableScreen detection/recovery).
+export const HEALTH = {
+  // Tolerant of cold mobile connections (radio wake + DNS + TLS + first byte). A hardcoded
+  // 5s here used to falsely flag slow devices as "service unavailable" while the real 30s
+  // API requests would have succeeded.
+  PROBE_TIMEOUT_MS: 12000,
+  // Re-probe before declaring the backend down so a single cold-connection blip can't blank
+  // the app. Total worst case to show the screen on a genuine outage stays under the API timeout.
+  CONFIRM_RETRIES: 1,
+  CONFIRM_RETRY_DELAY_MS: 1500,
+  // Recovery poll while the screen is shown — quick feedback once the backend answers again.
+  RECOVERY_POLL_INTERVAL_MS: 5000,
+} as const;