Release v0.5.0

Added

• Custom return URL endpoint for WEB_REDIRECT payments — avoids WooCommerce's "order already paid" error when the customer returns from Vipps
• Atomic payment-creation lock with UUID ownership to prevent duplicate payments and race conditions
• Norwegian phone number normalization — handles +47, 0047, spaces, and bare 8-digit local numbers
• completed flag in check_status response (true for CAPTURED/AUTHORIZED) so the frontend doesn't need to interpret Vipps states
• Token redaction in debug log output for redirect URLs
• Phone number PII masking in debug logs
• Null safety checks on API callers to prevent crashes when the gateway is misconfigured
• Type safety with string casts on order meta values and is_array() checks on API responses

Changed

• Return URL for WEB_REDIRECT now uses a lightweight custom endpoint (ReturnHandler) instead of WooCommerce's checkout-pay page
• Phone validation error message is more descriptive