fix: harden Easebuzz callback validation and outbound HTTP calls

[sankarsubramaniankvs]

Summary

• remove the guest-to-Administrator callback path and return explicit 400s for invalid callbacks
• verify Easebuzz callback hashes before mutating documents and ignore duplicate callback replays for the same transaction id
• require authentication for merchant key access instead of exposing it to guests
• add bounded timeout and retry/backoff handling for outbound Easebuzz HTTP requests
• add a lightweight smoke validation script for hash verification and retry behavior

Validation

• python3 -m compileall easebuzz
• python3 tests_security_smoke.py

Notes

• issue [Security] Public callback logs in as Administrator and processes untrusted payment payload #23, [Security] Webhook and response handler trust without signature/hash verification #24, [Security] Guest-accessible API exposes merchant key #25, and [Stability] Outbound Easebuzz HTTP calls have no timeout/retry controls #26 touch the same callback/settings/client surface, so they are fixed together in one hardening PR