Release MakePay Medusa plugin 1.0.0

[orangebtc]

Summary

Release @makecrypto/medusa-plugin-makepay@1.0.0 as the production Medusa 2 provider and Admin extension.

• preserves API-key compatibility and pp_makepay_makepay
• adds durable OAuth with encrypted tokens/DPoP material, transactional refresh rotation, idempotent recovery, automatic renewal after long idle periods, and explicit Disconnect/Reconnect
• adds installation-scoped webhooks, durable deduplication, strict correlation, monotonic terminal status handling, and safe pending-order hosted checkout
• adds the MakePay Admin settings page, searchable payment projection, order widget, read-only reconciliation, and branded sidebar logo
• adds the verified Next.js hosted-return flow and region/provider troubleshooting
• packages provider, module, routes, migrations, subscribers, Admin extensions, and public exports in one npm package

Release evidence

• frozen plugin tarball SHA-256: f89250fe8f2bb90c9be381496d171da7f864598d32719518c6f3b99e044d775c
• frozen @makecrypto/makepay@0.4.0 SHA-256: b597fc487f3be8829655505d5bbc2966eb02b80421ca6cf8a57d9a507d324672
• clean Medusa 2.17.2 + official Next.js starter packed-artifact E2E: OAuth and API-key scenarios passed
• real Demo sandbox merchant OAuth, scoped webhook, hosted checkout, Admin projection, and cleanup evidence captured without spending cryptocurrency
• four real-sandbox screenshots and four rendered documentation captures inspected at original resolution and bound to the one-time 1.0.0 campaign

Validation

• Node 22/24 typecheck, provider/Admin production builds, and package gates
• 153 unit/security tests
• SDK, OAuth, API-key, webhook, migration, and Admin contracts
• 29 evidence/campaign tamper-resistance tests
• 93-file package export/allowlist inspection; no source maps, secrets, or install hooks
• production dependency audit: 0 vulnerabilities
• immutable packed-artifact Medusa/storefront E2E: 2/2 passed

Release gate

The remaining dependency is the reviewed MakeCrypto guide being merged and live. After the live documentation gate and protected checks pass, this PR can be merged and the exact merge commit tagged v1.0.0 for npm trusted publishing with provenance.