XXPayUS / PixPayment response verification correction

Create and query API responses carry an envelope-level sign/signType, but
the signature covers the fields inside data only. The previous build included
the outer code/msg/data/signType fields in the signature calculation and
therefore rejected valid responses. The corrected build verifies the data
object using the saved merchant key and the documented MD5 canonical rules.

Successful responses require a valid signature and a non-empty data object.
Tampered data, a wrong key, missing/invalid signatures and unsupported signing
types are rejected. Extended data fields are included in verification.
Request signing, direct asynchronous callback verification, merchant/order/
amount/transaction checks, duplicate protection, split rules and one-minute
status checks retain their existing behavior. A browser return never proves
that an order was paid. Existing uncertain payment attempts are not retried.

Official documentation checked 2026-10-16:
https://www.showdoc.com.cn/2598837985264348/11558630444948117
https://www.showdoc.com.cn/2598837985264348/11558630445838945

Read-only live queries from both client WordPress sites confirmed that the
provider signatures match the data object, with no new payment creation.
Local WordPress, WooCommerce and standalone tests use simulated responses.
Merchant gateway and method activation are still required.
