v4.4.0 - Token amount lock + underpayment tolerance cap

Security

• Lock REAL8 token amount on first quote (M-wp-1). Abandoned checkouts no longer requote at the current REAL8/USD rate on return. The first quote is stored and reused for the same order and token for 24 hours (filter: real8_payment_hard_lock_seconds), so merchants no longer lose value when the price drops during a long-abandoned checkout.
• Cap underpayment tolerance at 5% (M-wp-2). The tolerance ceiling is now enforced server-side in the admin field, on settings save, and on every read. Existing installations above 5% are clamped on the next admin save or payment verification.

Also included since v4.3.1

This is the first published release after v4.3.1 and bundles the unreleased 4.3.x versions:

• 4.3.7 (security): removed the hardcoded REAL8_PAYMENT_INTENT_SECRET fallback that was committed to the public repository. Action required on upgrade: add define('REAL8_PAYMENT_INTENT_SECRET', '<64-hex-secret>'); to wp-config.php, matching PAYMENT_INTENT_SECRET in the api.real8.org .env. Without it, intent signing fails closed and checkout falls back to on-page payment instructions.
• 4.3.6: REAL8 equivalents shown on subscription recurring totals at checkout.
• 4.3.5: removed REAL8 amount from the order button; fixed bold styling on the checkout total.
• 4.3.3: fixed duplicate REAL8 price in cart and subtotal columns.
• 4.3.2: fixed duplicate REAL8 price on subscription product pages.