audit full project flows and harden backend

backend/worker/cmd/main/main.go

@@ -31,6 +31,7 @@ func main() {
 func closeExpiredPayments(ctx context.Context) {
 	ticker := time.NewTicker(time.Duration(config.Spec.PaymentAPI.IntervalSeconds) * time.Second)
 	defer ticker.Stop()
+	client := &http.Client{Timeout: 15 * time.Second}
 	for {
 		select {
 		case <-ctx.Done():
@@ -41,7 +42,7 @@ func closeExpiredPayments(ctx context.Context) {
 				continue
 			}
 			request.Header.Set("X-Heqi-Worker-Token", config.Spec.PaymentAPI.Token)
-			response, err := http.DefaultClient.Do(request)
+			response, err := client.Do(request)
 			if err == nil {
 				_ = response.Body.Close()
 			}