security: apply 11 audit findings (2 critical, 4 high, 5 medium/low)

SEC-001 CRITICAL: Remove spoofable X-Forwarded-For/X-Real-IP from IP detection; trust only CF-Connecting-IP + REMOTE_ADDR
SEC-004 HIGH: Add peptide name input validation with character whitelist and prompt injection blocking
SEC-006 HIGH: Add missing return after wp_send_json_success in handle_pending_retry max-retries block
SEC-007 MEDIUM: KB articles now respect auto_publish setting instead of always publishing
SEC-009 MEDIUM: Replace hardcoded page ID 73 with configurable kb_page_id setting
SEC-010 MEDIUM: Fix cache invalidation — add underscore prefix to transient name pattern
SEC-011 MEDIUM: Skip sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry
SEC-012 MEDIUM: Add global daily generation cap (50/day) to prevent cost overruns
SEC-013 LOW: Add @deprecated notice to unused PSA_Error class
SEC-015 LOW: Convert uninstall.php from space to tab indentation (WPCS)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

peptide-search-ai.php

@@ -48,7 +48,9 @@ add_action( 'admin_init', 'psa_admin_init' );
  * Uses is_page() which is reliable even in block templates.
  */
 function psa_is_kb_page() {
-	return is_page( 73 ) || is_page( 'peptide-database' );
+	$settings = get_option( 'psa_settings', array() );
+	$kb_page  = $settings['kb_page_id'] ?? 73;
+	return is_page( $kb_page ) || is_page( 'peptide-database' );
 }
 
 /**
@@ -169,8 +171,6 @@ register_deactivation_hook( __FILE__, 'psa_deactivate' );
 function psa_get_client_ip() {
 	$headers = array(
 		'HTTP_CF_CONNECTING_IP',
-		'HTTP_X_FORWARDED_FOR',
-		'HTTP_X_REAL_IP',
 		'REMOTE_ADDR',
 	);
 	foreach ( $headers as $header ) {