fix(cabinet): recover "Сервис недоступен" false-positive + top-up fixes

- health probe: tolerant timeout (12s) + retry before flagging the backend down. A
  hardcoded 5s probe racing auth bootstrap falsely showed ServiceUnavailableScreen on
  slow devices / cold mobile connections while the 30s API requests would have
  succeeded ("works on one device, not another on the same Wi-Fi"). The recovery poll
  self-reschedules with the tolerant timeout so slow devices auto-recover.
- TopUpAmount: fetch payment methods with a real query (fixes the infinite spinner on a
  cold cache / browser-back) and use canonical RUB for quick-amount chips so FX rounding
  can't reject a min-amount selection in non-RUB locales.
- settings UI: render secret values as a masked password input (pairs with the backend
  secret masking); leaving the field empty keeps the stored secret.
- deps: npm audit fix (18 -> 5 advisories).

Also bundles in-progress settings env-lock UI work.

src/locales/en.json

@@ -2000,6 +2000,8 @@
       "quickToggles": "Quick Toggles",
       "modified": "Modified",
       "readOnly": "Read only",
+      "envLocked": "Set in .env",
+      "envLockedHint": "This value is set in the .env file and overrides the database, so it can't be changed here. To manage it from the cabinet, remove the key from .env and restart the bot.",
       "badgeDb": "DB",
       "badgeEnv": "ENV",
       "reset": "Reset",

src/locales/fa.json

@@ -1704,6 +1704,8 @@
       "quickToggles": "تغییر سریع",
       "modified": "تغییر یافته",
       "readOnly": "فقط خواندنی",
+      "envLocked": "تنظیم‌شده در ‎.env‎",
+      "envLockedHint": "این مقدار در فایل ‎.env‎ تنظیم شده و پایگاه‌داده را بازنویسی می‌کند، بنابراین اینجا قابل تغییر نیست. برای مدیریت آن از پنل، کلید را از ‎.env‎ حذف کنید و ربات را ری‌استارت کنید.",
       "reset": "بازنشانی",
       "categoriesCount": "دسته",
       "settingsCount": "تنظیم",

src/locales/ru.json

@@ -2027,6 +2027,8 @@
       "quickToggles": "Быстрые переключатели",
       "modified": "Изменено",
       "readOnly": "Только чтение",
+      "envLocked": "Задано в .env",
+      "envLockedHint": "Значение задано в файле .env и перекрывает базу данных — здесь его изменить нельзя. Чтобы управлять настройкой из кабинета, удалите ключ из .env и перезапустите бота.",
       "badgeDb": "БД",
       "badgeEnv": "ENV",
       "reset": "Сбросить",

src/locales/zh.json

@@ -1745,6 +1745,8 @@
       "quickToggles": "快速开关",
       "modified": "已修改",
       "readOnly": "只读",
+      "envLocked": "在 .env 中设置",
+      "envLockedHint": "该值在 .env 文件中设置并覆盖数据库,因此无法在此处更改。若要从面板管理此设置,请从 .env 中删除该键并重启机器人。",
       "reset": "重置",
       "categoriesCount": "个分类",
       "settingsCount": "个设置",