I fixed `normalizeUsZip` in `src/normalize-us-zip.mjs`, and `npm test` now passes.

The bug was the lower limit on the five-digit base ZIP. The contract says it must be between 501 and 99950, but the code allowed 500, so `"00500"` was wrongly accepted. I changed `baseZip < 500` to `baseZip < 501`. The rest of the function already matched the contract.

I also ran some extra edge cases by hand, and they behaved as the contract says:
- `00501` and `99950` are accepted; `99951` is rejected.
- Non-breaking spaces and newlines are trimmed.
- Full-width digits, `new String(...)`, numbers and `undefined` are rejected.
- Badly formed ZIP+4 values, like `12345-123`, are rejected.

No other files were changed, and I didn't write `notes/attempt.txt`.