refactor: 提取 service 层 best-effort 超时常量

- 新增 defaultBETimeout = 5 * time.Second
- 替换 auth/auth_runtime/password_reset/user_service/webhook 中 6 处硬编码 5*time.Second

internal/service/user_service.go

@@ -132,7 +132,7 @@ func (s *UserService) ChangePassword(ctx context.Context, userID int64, oldPassw
 		if s.passwordHistoryRepo != nil {
 			// #nosec G118 - 使用带超时的独立 context（不能使用请求 ctx，该 goroutine 在请求完成后仍可能运行）
 			go func(hashedPw string) { // #nosec G118
-				bgCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+				bgCtx, cancel := context.WithTimeout(context.Background(), defaultBETimeout)
 				defer cancel()
 				_ = s.passwordHistoryRepo.Create(bgCtx, &domain.PasswordHistory{
 					UserID:       userID,
@@ -199,7 +199,7 @@ func (s *UserService) applyNewPassword(ctx context.Context, user *domain.User, n
 					log.Printf("user_service: password history save panic recovered, user_id=%d err=%v", userID, r)
 				}
 			}()
-			bgCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			bgCtx, cancel := context.WithTimeout(context.Background(), defaultBETimeout)
 			defer cancel()
 			_ = s.passwordHistoryRepo.Create(bgCtx, &domain.PasswordHistory{
 				UserID:       userID,