security: apply 11 audit findings (2 critical, 4 high, 5 medium/low)

SEC-001 CRITICAL: Remove spoofable X-Forwarded-For/X-Real-IP from IP detection; trust only CF-Connecting-IP + REMOTE_ADDR
SEC-004 HIGH: Add peptide name input validation with character whitelist and prompt injection blocking
SEC-006 HIGH: Add missing return after wp_send_json_success in handle_pending_retry max-retries block
SEC-007 MEDIUM: KB articles now respect auto_publish setting instead of always publishing
SEC-009 MEDIUM: Replace hardcoded page ID 73 with configurable kb_page_id setting
SEC-010 MEDIUM: Fix cache invalidation — add underscore prefix to transient name pattern
SEC-011 MEDIUM: Skip sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry
SEC-012 MEDIUM: Add global daily generation cap (50/day) to prevent cost overruns
SEC-013 LOW: Add @deprecated notice to unused PSA_Error class
SEC-015 LOW: Convert uninstall.php from space to tab indentation (WPCS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

includes/class-psa-error.php

@@ -3,7 +3,8 @@
  * Standardized error handling for Peptide Search AI.
  * Provides a unified interface for sending error responses with consistent structure.
  *
- * @package PeptideSearchAI
+ * @package    PeptideSearchAI
+ * @deprecated 4.1.0 Currently unused. Retained for potential future integration.
  */
 
 if ( ! defined( 'ABSPATH' ) ) {