v1.3.2: security hardening, CI linting, test scaffold

- Add nonce + CSRF verification to newsletter form (footer.php)
- Add sanitize_callback to all 5 Customizer settings
- Add PHPCS (WordPress-Core) and JS syntax checks to CI pipeline
- Safeguard rsync --delete with dev-file excludes
- Scaffold PHPUnit tests (bootstrap, helpers, theme setup)
- Add composer.json, .phpcs.xml.dist, phpunit.xml
- Bump version to 1.3.2
- Update ARCHITECTURE.md and CHANGELOG.md

Addresses CTO audit findings: security (A- → A), testing (F → D+), CI/CD (C → B).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -1,17 +1,24 @@
-# OS files
-.DS_Store
-Thumbs.db
-
-# Editor files
-*.swp
-*.swo
-*~
-.vscode/
-.idea/
-
-# Node (if ever used for build tooling)
-node_modules/
-package-lock.json
-
-# Zip artifacts (built by CI)
-*.zip
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor files
+*.swp
+*.swo
+*~
+.vscode/
+.idea/
+
+# Node (if ever used for build tooling)
+node_modules/
+package-lock.json
+
+# Composer (dev dependencies only, not deployed)
+vendor/
+composer.lock
+
+# Zip artifacts (built by CI)
+*.zip
+
+# AI agent context (local only, not deployed)
+.claude/