v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

inc/page-setup.php

@@ -1,16 +1,18 @@
 <?php
 /**
- * Auto-Create Pages on Theme Activation
+ * Auto-Create Pages + v1.5.0 User Migration
  *
- * Creates the required WordPress pages (with correct templates assigned)
- * when the theme is activated, if they don't already exist.
+ * On theme activation, creates the required WordPress pages with the
+ * correct templates assigned, and runs a one-time migration that enrols
+ * pre-v1.5.1 users into the email-verification flow.
  *
  * @see functions.php — includes this file
- * @see ARCHITECTURE.md — documents the page/template mapping
+ * @see inc/email-verification.php — peptide_starter_send_verification_email()
+ * @see ARCHITECTURE.md — page/template map
  *
- * What: Theme activation hook that auto-creates pages for all new templates.
- * Who calls it: WordPress after_switch_theme action.
- * Dependencies: None — uses WordPress core functions only.
+ * What: Theme-activation hooks for page provisioning and user enrolment.
+ * Who calls it: WordPress after_switch_theme.
+ * Dependencies: wp_insert_post, update_post_meta, user meta.
  *
  * @package peptide-starter
  */
@@ -23,8 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 /**
  * Create required pages on theme activation.
  *
- * Checks if each page slug exists; creates it if missing with the
- * correct page template assigned. Skips existing pages to avoid duplicates.
+ * Idempotent: re-assigns the template on existing pages.
  *
  * @return void
  */
@@ -81,7 +82,6 @@ function peptide_starter_create_pages() {
 		$existing = get_page_by_path( $page_data['slug'] );
 
 		if ( $existing ) {
-			// Page exists — ensure the template is assigned.
 			update_post_meta( $existing->ID, '_wp_page_template', $page_data['template'] );
 			continue;
 		}
@@ -103,3 +103,52 @@ function peptide_starter_create_pages() {
 	}
 }
 add_action( 'after_switch_theme', 'peptide_starter_create_pages' );
+
+/**
+ * One-time migration: enrol v1.5.0 subscribers into email verification.
+ *
+ * Runs once per site — guarded by the ps_verify_migration_version option.
+ * Iterates subscribers in batches of 50 via wp_mail(). Users created by
+ * admin (any role above subscriber) are skipped — we assume admin-created
+ * accounts are trusted.
+ *
+ * Side effects: writes user meta + sends email per enrolled user.
+ *
+ * Cost note: worst case N emails on first admin page load after deploy.
+ * If the site has many users, move this to WP-Cron before shipping a
+ * large-user release (not a concern for the current zero-user site).
+ *
+ * @return void
+ */
+function peptide_starter_migrate_existing_users_to_verification() {
+	if ( ! is_admin() ) {
+		return;
+	}
+	$done = get_option( 'ps_verify_migration_version' );
+	if ( PEPTIDE_STARTER_VERSION === $done ) {
+		return;
+	}
+
+	$subscribers = get_users(
+		array(
+			'role'    => 'subscriber',
+			'fields'  => array( 'ID' ),
+			'number'  => 500,
+			'orderby' => 'ID',
+			'order'   => 'ASC',
+		)
+	);
+
+	foreach ( $subscribers as $user ) {
+		$already_enrolled = get_user_meta( $user->ID, 'ps_pending_verification', true );
+		if ( '' !== (string) $already_enrolled ) {
+			continue;
+		}
+		if ( function_exists( 'peptide_starter_send_verification_email' ) ) {
+			peptide_starter_send_verification_email( $user->ID );
+		}
+	}
+
+	update_option( 'ps_verify_migration_version', PEPTIDE_STARTER_VERSION, false );
+}
+add_action( 'admin_init', 'peptide_starter_migrate_existing_users_to_verification' );