Fix e-payment settings payload, cart race, and media/content helpers.

Stop returning passwordSet (forbidNonWhitelisted), upsert carts safely, and harden related media/product/workshop flows.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/business-settings/business-settings.types.ts

@@ -54,7 +54,7 @@ export type MellatGatewaySettings = {
   enabled: boolean;
   terminalId: string;
   username: string;
-  /** Stored secret — redacted in API responses; use passwordSet instead. */
+  /** Stored secret — never returned in API responses (always empty string). */
   password: string;
 };