feat: remove AI thumbnails, rewrite frontend with React (v1.3.0)

Remove all AI thumbnail generation infrastructure (too expensive,
poor results) and rewrite the public-facing article feed as a React
SPA mounted via WordPress shortcode.

Changes:
- Remove thumbnail generation, OG scraping, and image download code
  from fetcher, LLM, and admin classes
- Replace server-rendered PHP templates with React component
  (PeptideNewsFeed.jsx) using WordPress-bundled React/ReactDOM
- Add Babel build pipeline for JSX transpilation
- Update REST API to serve ai_summary instead of thumbnail fields
- Redesign public CSS: clean card layout, loading skeletons,
  dark mode, responsive, no thumbnail imagery
- Remove dead admin settings (llm_image_model, thumbnail_fallback)
- Fix call_openrouter() visibility for Content Filter cross-class use
- Bump version to 1.3.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

public/js/public-script.js

@@ -1,83 +1,9 @@
 /**
- * Peptide News — Public Click Tracker
+ * Peptide News — Legacy Click Tracker (deprecated)
  *
- * Tracks outbound clicks on article links via AJAX and
- * manages visitor session cookies.
+ * Click tracking is now handled by the React feed component.
+ * This file is kept as an empty placeholder for backward compatibility.
  *
  * @since 1.0.0
+ * @deprecated 2.0.0 Use peptide-news-feed.js instead.
  */
-(function ($) {
-    'use strict';
-
-    // Set session cookie if it doesn't exist.
-    function initSession() {
-        if (!getCookie('pn_session_id')) {
-            var sessionId = peptideNewsPublic.session_id || generateUUID();
-            setCookie('pn_session_id', sessionId, 30); // 30-minute cookie
-        }
-    }
-
-    function getCookie(name) {
-        var match = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
-        return match ? decodeURIComponent(match[2]) : null;
-    }
-
-    function setCookie(name, value, minutes) {
-        var d = new Date();
-        d.setTime(d.getTime() + minutes * 60 * 1000);
-        var cookie = name + '=' + encodeURIComponent(value) +
-            ';expires=' + d.toUTCString() +
-            ';path=/;SameSite=Lax';
-        if (window.location.protocol === 'https:') {
-            cookie += ';Secure';
-        }
-        document.cookie = cookie;
-    }
-
-    function generateUUID() {
-        return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {
-            var r = (Math.random() * 16) | 0;
-            var v = c === 'x' ? r : (r & 0x3) | 0x8;
-            return v.toString(16);
-        });
-    }
-
-    // Track click via AJAX (fire-and-forget with beacon fallback).
-    function trackClick(articleId) {
-        var data = {
-            action: 'peptide_news_track_click',
-            nonce: peptideNewsPublic.nonce,
-            article_id: articleId,
-            referrer: document.referrer || '',
-            page_url: window.location.href,
-            session_id: getCookie('pn_session_id') || '',
-        };
-
-        // Try sendBeacon first (non-blocking, survives page navigation).
-        if (navigator.sendBeacon) {
-            var formData = new FormData();
-            Object.keys(data).forEach(function (key) {
-                formData.append(key, data[key]);
-            });
-            navigator.sendBeacon(peptideNewsPublic.ajax_url, formData);
-            return;
-        }
-
-        // Fallback to AJAX.
-        $.post(peptideNewsPublic.ajax_url, data);
-    }
-
-    $(document).ready(function () {
-        initSession();
-
-        // Delegate click events on tracked links.
-        $(document).on('click', '.pn-track-click', function () {
-            var articleId = $(this).data('article-id');
-            if (articleId) {
-                trackClick(articleId);
-            }
-            // Don't prevent default — let the link open normally.
-        });
-    });
-
-})(jQuery);