v2.0.0

Breaking security release that retires browser Public Key order creation, Session Tokens, browser order/status APIs, and signed checkout URL construction. Browser integrations now open only server-created Hosted Checkout URLs through PolyPayCheckout. Server-side x402 support remains available.