v1.1.1 — detection hardening (no silently-missed payments)

Hardening fix (no settings or data change; upgrade recommended).

detect_in_tx wrapped the ownership test and the amount/commitment decode in a single
catch(\Throwable){continue}. A decode error on an output that IS the merchant's (a pruned
node, a malformed tx blob) was indistinguishable from "not ours" and could report a real
payment as unpaid. The catch is now split at the ownership boundary: a non-curve-point
candidate is still treated as "not ours", but once ownership matches, an undecodable output
fails closed and is surfaced (found-but-unverified), never silently missed.

Verified against 3 real stagenet payments end to end (total 0.12 XMR), matching the xmr-pay
JavaScript library and the new pure-PHP package.