fix: comprehensive code quality remediation from audit findings

Security (7 fixes):
- SEC-001: Use wpdb->prepare() for COUNT query in REST API
- SEC-002: Set httponly=true on session cookie to prevent XSS
- SEC-003: Mask API keys in admin settings (show last 4 chars only)
- SEC-004: Check capability before nonce in manual fetch handler
- SEC-005: Validate redirect domains to prevent open redirects
- SEC-006: Escape all article fields before REST API response
- SEC-007: Add capability check to AJAX summary handler

Infrastructure (7 fixes):
- WPS-002: Clear cron schedule on plugin deactivation
- WPS-003: Bundle Chart.js locally instead of CDN without SRI
- WPS-004: Add uninstall.php for clean plugin removal
- DB-001: Add foreign key constraints with CASCADE deletes
- DB-002: Clamp pagination to valid page range
- CI-001: Use StrictHostKeyChecking=accept-new in deploy
- CI-002: Add security scanning step to CI pipeline
- CI-003: Add rollback workflow via workflow_dispatch

Performance & Quality (8 fixes):
- PHP-001: Validate widget $instance as array before access
- PHP-002: Return null from get_client_ip() for invalid IPs
- PHP-003: Process RSS feeds in chunked batches of 10
- PHP-004: Wire up clear_article_cache() in fetch cycle
- PERF-001: Cache source names in transient for strip_source_suffix
- PERF-002: Add server-side transient caching for REST API
- ARCH-002: Make LLM API URL configurable via WordPress options

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -30,6 +30,39 @@ jobs:
       - name: Syntax check all PHP files
         run: find . -name '*.php' -not -path './vendor/*' -not -path './peptide-news-plugin/*' -print0 | xargs -0 -n1 php -l
 
+  # ── Security Audit ───────────────────────────────────────────────
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for common PHP security issues
+        run: |
+          echo ":: Checking for direct SQL queries without prepare..."
+          if grep -r "query\s*(\s*['\"].*\$" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null | grep -v "\\\$wpdb->prepare" && [ ${PIPESTATUS[0]} -eq 0 ]; then
+            echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
+            exit 1
+          fi
+
+          echo ":: Checking for eval() usage..."
+          if grep -r "eval\s*(" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
+            echo "ERROR: eval() found. This is a critical security risk."
+            exit 1
+          fi
+
+          echo ":: Checking for base64_decode without validation..."
+          if grep -r "base64_decode\s*(" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
+            echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
+          fi
+
+          echo ":: Checking for file_get_contents with user input..."
+          if grep -r "file_get_contents\s*(\s*\$" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
+            echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
+          fi
+
+          echo "All security checks passed."
+
   # ── PHPCS Coding Standards ───────────────────────────────────────
   phpcs:
     name: PHPCS