feat: YuKassa payment integration

- services/yukassa.js: createPayment, handleWebhook
  createPayment → создаёт платёж + сохраняет в payment_orders
  handleWebhook → activates plan + charges credits on payment.succeeded
- routes/billing.js: POST /checkout, POST /webhook (публичный)
- DB: payment_orders table
- index.js: /api/billing/webhook публичный (до auth middleware)

index.js

@@ -46,6 +46,16 @@ app.get('/api/billing/plans', async (req, res) => {
   res.json({ plans, costs });
 });
 
+// ЮKassa webhook — публичный, без internal secret
+app.post('/api/billing/webhook',
+  express.json({ type: '*/*' }),
+  require('./src/routes/billing').handle || ((req, res, next) => {
+    require('./src/services/yukassa').handleWebhook(req.body)
+      .then(r => res.json({ ok: true, ...r }))
+      .catch(err => res.status(500).json({ error: err.message }));
+  })
+);
+
 // Simple internal auth middleware
 app.use((req, res, next) => {
   const secret = req.headers['x-internal-secret'];