v0.2.2 — fixes from an adversarial review

0.2.1 was reviewed adversarially by a second model after it had been declared
ready, and it found real defects. Every one below was reproduced before being
fixed, and each now has a test that fails against the old behaviour.

No reconfiguration needed. The two "this month" sensors change state class,
which affects how Home Assistant records their long-term statistics.

The one that mattered

A failed poll could pin the schedule. The next poll time was recalculated
only after a successful update, and Home Assistant re-arms a failed refresh
with the interval unchanged. So a failure froze whatever interval was last set
and repeated it forever — through the night, and including the 60-second
minimum, which turned the guard against a runaway loop into the cause of one.
A failed poll now simply waits for the next scheduled slot.

Wrong values that looked right

• An empty page from the API counted as "all done", so a server answering
  "here are 0 records, there are 100" produced a confident zero lifetime
  cycling days. Now an error. Paging also follows what was actually returned,
  so a server that caps its page size can no longer make the integration skip
  records silently.
• The euro value over-claimed. A catalogue split 60/40 between two rates
  still produced a number, despite the README promising unknown. Articles not
  yet on sale, expired, or carrying a handling fee were all counted. And
  "Cadeaukaart € 1 000" was read as one euro, while a name like
  "Artikel van € 100 voor € 25" took the wrong figure. Ambiguous names are
  now dropped rather than guessed at.
• The commute distance ignored whether a registration was in force, so one
  starting next month immediately replaced the current one, and an expired one
  was reported indefinitely.
• "This month" sensors could lose a month. They were total_increasing,
  which infers a reset from a decrease it observes — but nothing polls
  overnight, so a month ending on one cycling day followed by a first day that
  already shows one looks like no change at all, and the new month's first day
  vanished from statistics. They are now total with an explicit reset time.

Privacy

• Error messages could echo content from the API response. A malformed date
  field was quoted verbatim into the log, which contradicts this integration's
  rule of logging only the endpoint and status code.
• The repository's leak guard now checks commit messages as well as file
  contents. It previously did not, and that gap had already been used: an
  account figure was removed from the files and from a published release note,
  and then described in the commit message that removed it. Two further holes
  in the guard are fixed as well.

Also

The documentation claimed the session token always expires between polls and
that the shop catalogue is fetched at most once a day. Neither was true.
Real traffic is roughly 25-30 requests a day, not 20, and the README now says
so.