Payment cURL has no connect/read timeout (worker hang, double-charge risk)

The payment request has no timeout, so a slow gateway can hang server workers and risk double charges.

Checkout.php:99