fix: comprehensive code quality remediation from audit findings

Security (7 fixes):
- SEC-001: Use wpdb->prepare() for COUNT query in REST API
- SEC-002: Set httponly=true on session cookie to prevent XSS
- SEC-003: Mask API keys in admin settings (show last 4 chars only)
- SEC-004: Check capability before nonce in manual fetch handler
- SEC-005: Validate redirect domains to prevent open redirects
- SEC-006: Escape all article fields before REST API response
- SEC-007: Add capability check to AJAX summary handler

Infrastructure (7 fixes):
- WPS-002: Clear cron schedule on plugin deactivation
- WPS-003: Bundle Chart.js locally instead of CDN without SRI
- WPS-004: Add uninstall.php for clean plugin removal
- DB-001: Add foreign key constraints with CASCADE deletes
- DB-002: Clamp pagination to valid page range
- CI-001: Use StrictHostKeyChecking=accept-new in deploy
- CI-002: Add security scanning step to CI pipeline
- CI-003: Add rollback workflow via workflow_dispatch

Performance & Quality (8 fixes):
- PHP-001: Validate widget $instance as array before access
- PHP-002: Return null from get_client_ip() for invalid IPs
- PHP-003: Process RSS feeds in chunked batches of 10
- PHP-004: Wire up clear_article_cache() in fetch cycle
- PERF-001: Cache source names in transient for strip_source_suffix
- PERF-002: Add server-side transient caching for REST API
- ARCH-002: Make LLM API URL configurable via WordPress options

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

includes/class-peptide-news-analytics.php

@@ -23,6 +23,11 @@ class Peptide_News_Analytics {
 
         $ip = isset( $meta['ip'] ) ? $meta['ip'] : self::get_client_ip();
 
+        // Skip recording if no valid IP is available.
+        if ( null === $ip ) {
+            return false;
+        }
+
         // Optionally anonymize IP (GDPR-friendly).
         if ( get_option( 'peptide_news_anonymize_ip', 1 ) ) {
             $ip = self::anonymize_ip( $ip );
@@ -287,7 +292,7 @@ class Peptide_News_Analytics {
     /**
      * Get the client IP address.
      *
-     * @return string
+     * @return string|null
      */
     private static function get_client_ip() {
         $ip_keys = array( 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'REMOTE_ADDR' );
@@ -302,7 +307,7 @@ class Peptide_News_Analytics {
             }
         }
 
-        return '0.0.0.0';
+        return null;
     }
 
     /**