v0.1.1

Changed

• The default external_user_id sent to FaceVault is now an opaque per-user
  random reference stored in user meta instead of the raw WP user id, whose
  sequential values made verification-status enumeration possible through
  FaceVault's public status poll. Sites overriding the
  facevault_external_user_id filter are unaffected, and webhooks for
  sessions minted by 0.1.0 (which echo the raw id) still apply.
• Documented that the webhook receiver's malformed-JSON guard only fires for
  non-JSON content types — WordPress rejects malformed application/json
  bodies before dispatch.

v0.1.0

Added

• Initial plugin: settings page with setup checklist and connection test,
  verify button (shortcode + Gutenberg block), HMAC-verified webhook
  receiver, WooCommerce My Account "Identity Verification" tab, and a
  status-poll fallback for hosts that cannot receive webhooks.