- PaymentStatus: 6-state lifecycle (pending/confirming/completed/failed/
  expired/refunded) with a validated transition table + Display + serde
- fx: FX drift guard ported from ecom-core (200 bps tolerance)
- webhooks: fail-closed verifiers for Fena (HMAC-hex), Wallid (timestamped
  sha256= + replay window), Bacs DD (hex) — ports of the ecom-engine HTTP
  schemes, shared so both consumers verify identically
- decimal-money bumped to 1.x; serde behind a default feature
- BREAKING: decimal-money 0.2 -> 1, new modules behind the default feature

v0.2.0