fix: address QA P1 + P2 findings from 9aa5309 review

P1 fix: Add class_exists() guard in PRC_Preset_Provider before
instantiating PR Core repository classes. If PR Core constant is
defined but classes fail to autoload, fall back to defaults instead
of crashing.

P2 fixes:
- Remove unused nonce from wp_localize_script (all endpoints public)
- Add cross-reference comments pinning SYRINGE_UNITS_PER_ML across
  PRC_Math, calculator.js, and prcConfig.syringeUnits

QA verdict: qa-reviews/peptide-reconstitution-calculator/2026-04-17-9aa5309.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

includes/frontend/class-prc-shortcode.php

@@ -93,13 +93,13 @@ class PRC_Shortcode {
 			true
 		);
 
-		// Pass presets and config to JS.
+		// Pass presets and config to JS — all REST endpoints are public-read,
+		// so no nonce is needed. The restUrl is provided for future use.
 		$provider = new PRC_Preset_Provider();
 		wp_localize_script( 'prc-calculator', 'prcConfig', [
 			'presets'      => $provider->get_all_presets(),
 			'restUrl'      => esc_url_raw( rest_url( 'prc/v1' ) ),
-			'nonce'        => wp_create_nonce( 'wp_rest' ),
-			'syringeUnits' => 100,
+			'syringeUnits' => 100, // Must match PRC_Math::SYRINGE_UNITS_PER_ML and calculator.js SYRINGE_UNITS_PER_ML.
 			'i18n'         => [
 				'selectPeptide'  => __( 'Select a peptide…', 'peptide-reconstitution-calculator' ),
 				'customEntry'    => __( 'Custom / Manual Entry', 'peptide-reconstitution-calculator' ),