fix: comprehensive code quality remediation from audit findings

Security (7 fixes):
- SEC-001: Use wpdb->prepare() for COUNT query in REST API
- SEC-002: Set httponly=true on session cookie to prevent XSS
- SEC-003: Mask API keys in admin settings (show last 4 chars only)
- SEC-004: Check capability before nonce in manual fetch handler
- SEC-005: Validate redirect domains to prevent open redirects
- SEC-006: Escape all article fields before REST API response
- SEC-007: Add capability check to AJAX summary handler

Infrastructure (7 fixes):
- WPS-002: Clear cron schedule on plugin deactivation
- WPS-003: Bundle Chart.js locally instead of CDN without SRI
- WPS-004: Add uninstall.php for clean plugin removal
- DB-001: Add foreign key constraints with CASCADE deletes
- DB-002: Clamp pagination to valid page range
- CI-001: Use StrictHostKeyChecking=accept-new in deploy
- CI-002: Add security scanning step to CI pipeline
- CI-003: Add rollback workflow via workflow_dispatch

Performance & Quality (8 fixes):
- PHP-001: Validate widget $instance as array before access
- PHP-002: Return null from get_client_ip() for invalid IPs
- PHP-003: Process RSS feeds in chunked batches of 10
- PHP-004: Wire up clear_article_cache() in fetch cycle
- PERF-001: Cache source names in transient for strip_source_suffix
- PERF-002: Add server-side transient caching for REST API
- ARCH-002: Make LLM API URL configurable via WordPress options

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

uninstall.php

@@ -0,0 +1,24 @@
+<?php
+if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
+    exit;
+}
+global $wpdb;
+$prefix = $wpdb->prefix;
+
+// Drop custom tables.
+$wpdb->query( "DROP TABLE IF EXISTS {$prefix}peptide_news_clicks" );
+$wpdb->query( "DROP TABLE IF EXISTS {$prefix}peptide_news_daily_stats" );
+$wpdb->query( "DROP TABLE IF EXISTS {$prefix}peptide_news_articles" );
+
+// Delete all plugin options.
+$wpdb->query(
+    "DELETE FROM {$wpdb->options} WHERE option_name LIKE 'peptide\_news\_%'"
+);
+
+// Remove transient caches.
+$wpdb->query(
+    "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_peptide\_news\_%' OR option_name LIKE '_transient_timeout_peptide\_news\_%'"
+);
+
+// Clear scheduled events.
+wp_clear_scheduled_hook( 'peptide_news_cron_fetch' );