PayPal Checkout

- Subscriptions: added provider-agnostic reusable-payment-method setup. Declares the reusable_setup capability and implements begin_setup(), which creates a PayPal Vault v3 setup token so the storefront can save a reusable PayPal method WITHOUT charging.
- Checkout handler: added an initializeSetup(bundle, container, onToken, onError) entry that renders the PayPal Vault buttons (createVaultSetupToken / onApprove) and returns the approved setup token, which the generic finalize step exchanges for a permanent vault payment token.

- SECURITY: authorize() no longer returns the PayPal order id as if it were an authorization id. An intent=AUTHORIZE order is now authorized (POST /v2/checkout/orders/{id}/authorize) once approved, and the real authorization id is used for capture/void; capture()/void() resolve an approved-order id to the authorization id automatically.
- SECURITY: Subscription one-time charge treats only COMPLETED as success (APPROVED is not captured), preventing revenue being recorded for uncaptured orders; the subscription webhook verifier now fails CLOSED when webhook_id is missing and enforces transmission-time freshness.
- SECURITY: Idempotency keys (PayPal-Request-Id) on order/checkout/subscription creation, capture and refund are derived from an explicit per-attempt/request id (never a random UUID or order_id alone), so lost-response retries de-dup while retries with a new card and distinct partial captures/refunds are not collapsed. Refunds require an explicit refund id to be idempotent.
- SECURITY: Webhook verification enforces transmission-time freshness (5-minute window) to defuse replay.
- Refunds no longer default a missing status to COMPLETED; an incomplete response is reported as failed rather than a completed refund with a null id.
- Zero-decimal currency amounts (JPY/HUF/TWD/KRW) are rounded (ROUND_HALF_UP), not truncated, fixing ~1-unit undercharges.
- Subscription cancellation reports cancel_at_period_end=False because PayPal's cancel endpoint always cancels immediately.
- cancel_payment_intent() reports the operation as unsupported instead of falsely reporting a still-active/capturable order as cancelled.

- Added **kwargs to create_payment_intent_for_checkout for forward-compatible parameter passing from orchestration service

- Fixed webhook URL in setup instructions (was /payment-providers/webhook/{slug}/, corrected to /webhooks/payments/{slug}/)

- Initial release with full PayPal Orders API v2 integration
- Support for PayPal wallet, Venmo, and PayPal Credit
- Credit and debit card processing (Visa, Mastercard, Amex, Discover, JCB)
- Buy Now Pay Later with Pay in 4 and Pay Monthly
- Full and partial refund capabilities
- Webhook integration with server-side signature verification
- Multi-currency support across 25+ currencies
- Authorize and capture payment flows