fix(cabinet): recover "Сервис недоступен" false-positive + top-up fixes

- health probe: tolerant timeout (12s) + retry before flagging the backend down. A
  hardcoded 5s probe racing auth bootstrap falsely showed ServiceUnavailableScreen on
  slow devices / cold mobile connections while the 30s API requests would have
  succeeded ("works on one device, not another on the same Wi-Fi"). The recovery poll
  self-reschedules with the tolerant timeout so slow devices auto-recover.
- TopUpAmount: fetch payment methods with a real query (fixes the infinite spinner on a
  cold cache / browser-back) and use canonical RUB for quick-amount chips so FX rounding
  can't reject a min-amount selection in non-RUB locales.
- settings UI: render secret values as a masked password input (pairs with the backend
  secret masking); leaving the field empty keeps the stored secret.
- deps: npm audit fix (18 -> 5 advisories).

Also bundles in-progress settings env-lock UI work.

src/locales/fa.json

@@ -1704,6 +1704,8 @@
       "quickToggles": "تغییر سریع",
       "modified": "تغییر یافته",
       "readOnly": "فقط خواندنی",
+      "envLocked": "تنظیم‌شده در ‎.env‎",
+      "envLockedHint": "این مقدار در فایل ‎.env‎ تنظیم شده و پایگاه‌داده را بازنویسی می‌کند، بنابراین اینجا قابل تغییر نیست. برای مدیریت آن از پنل، کلید را از ‎.env‎ حذف کنید و ربات را ری‌استارت کنید.",
       "reset": "بازنشانی",
       "categoriesCount": "دسته",
       "settingsCount": "تنظیم",