security: apply 11 audit findings (2 critical, 4 high, 5 medium/low)

SEC-001 CRITICAL: Remove spoofable X-Forwarded-For/X-Real-IP from IP detection; trust only CF-Connecting-IP + REMOTE_ADDR
SEC-004 HIGH: Add peptide name input validation with character whitelist and prompt injection blocking
SEC-006 HIGH: Add missing return after wp_send_json_success in handle_pending_retry max-retries block
SEC-007 MEDIUM: KB articles now respect auto_publish setting instead of always publishing
SEC-009 MEDIUM: Replace hardcoded page ID 73 with configurable kb_page_id setting
SEC-010 MEDIUM: Fix cache invalidation — add underscore prefix to transient name pattern
SEC-011 MEDIUM: Skip sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry
SEC-012 MEDIUM: Add global daily generation cap (50/day) to prevent cost overruns
SEC-013 LOW: Add @deprecated notice to unused PSA_Error class
SEC-015 LOW: Convert uninstall.php from space to tab indentation (WPCS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

includes/class-psa-config.php

@@ -20,6 +20,9 @@ class PSA_Config {
 	const REST_RATE_LIMIT = 20;
 	const AJAX_RATE_LIMIT = 10;
 
+	// Daily generation cap
+	const DAILY_GENERATION_CAP   = 50;
+
 	// Generation timing
 	const PENDING_TIMEOUT        = 300; // seconds (5 minutes)
 	const MAX_GENERATION_RETRIES = 3;