v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CONVENTIONS.md

@@ -592,6 +592,84 @@ echo get_theme_mod( 'hero_title' );
 echo get_theme_mod( 'dark_mode_default', false );
 ```
 
+## Security Patterns (v1.5.1)
+
+### Rate-limit a handler
+
+Every new public POST handler must be rate-limited.
+
+```php
+// After nonce + honeypot checks.
+$identifier = peptide_starter_hash_identifier( strtolower( $email ) ); // or 'ip' for IP-only bucket
+if ( ! Peptide_Starter_Rate_Limiter::check( 'login', $identifier ) ) {
+    // Respond with the SAME message the real-validation-failure path uses.
+    wp_send_json_error( array( 'message' => peptide_starter_login_failure_message() ) );
+}
+Peptide_Starter_Rate_Limiter::record( 'login', $identifier ); // on failure
+// ...successful operation...
+Peptide_Starter_Rate_Limiter::reset( 'login', $identifier ); // on success
+```
+
+Pick a short action slug. Register its limit in `inc/config.php` under
+`rate_limits`. Never hardcode numbers in the handler.
+
+### Honeypot a form
+
+1. Render the trap in the form template part:
+
+```php
+<?php peptide_starter_render_honeypot( 'myform' ); ?>
+```
+
+2. In the handler, right after nonce verification:
+
+```php
+if ( peptide_starter_honeypot_triggered( 'ps_hp_myform' ) ) {
+    // Fake-success response — do NOT return an error. Bots learn from errors.
+    wp_send_json_success( array( 'message' => __( 'OK', 'peptide-starter' ) ) );
+}
+```
+
+### Gate a template
+
+At the very top of the template, after the `ABSPATH` guard, before
+`get_header()`:
+
+```php
+peptide_starter_require_login();
+```
+
+This redirects unauthenticated users to `/auth?redirect_to=current-uri`
+and unverified users to `/profile?verify_required=1`. Do not reinvent
+this per-template.
+
+### CSV-safe export
+
+Route every cell through the helper before `fputcsv`:
+
+```php
+fputcsv( $output, array(
+    peptide_starter_csv_safe( $email ),
+    peptide_starter_csv_safe( $date ),
+) );
+```
+
+### Error unification
+
+Login + registration failures must emit the same message regardless of
+which validation check failed. Use:
+
+- `peptide_starter_login_failure_message()` — "Invalid email or password."
+- `peptide_starter_register_failure_message()` — "Unable to create account..."
+
+Branching on failure reason is an enumeration oracle. Don't do it.
+
+### Adding a new security threshold
+
+Add a key to the defaults array in `inc/config.php` and always read it
+via `peptide_starter_config_get()` or the shortcut helpers. No magic
+numbers in handler files.
+
 ## Related Documentation
 
 - **ARCHITECTURE.md** — System design, data flows, integrations