fix(coinpay): guard invalid webhook tolerance config

[aiirvizionz]

Summary

• Keep CoinPay webhook timestamp tolerance enforcement active when config receives invalid numeric values.
• Preserve the explicit 0 escape hatch for disabling timestamp checks, while falling back to the default 300 seconds for NaN, negative, or otherwise invalid values.
• Add a regression test showing stale but correctly signed CoinPay webhooks are rejected when config contains Number.NaN.

Validation

• git diff --check

I attempted pnpm vitest run packages/payments/coinpay/src/index.test.ts and pnpm --filter @profullstack/sh1pt-payment-coinpay typecheck, but this checkout stops during dependency preparation because the committed lockfile fails the active supply-chain policy: @profullstack/autoblog@0.4.0 has no tarball integrity field. I did not modify the lockfile; the regression test is included for maintainers' normal CI/runtime.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.

[github-actions]

🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.