v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

style.css

@@ -4,7 +4,7 @@ Theme URI: https://github.com/peptiderepo/peptide-starter
 Description: Premium, accessible WordPress theme for scientific peptide reference database
 Author: Peptide Repo
 Author URI: https://peptiderepo.com
-Version: 1.5.0
+Version: 1.5.1
 License: GPL v2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 Text Domain: peptide-starter
@@ -3077,3 +3077,79 @@ html[data-theme="dark"] .ps-modules-section {
 /* ============================================================================
    END OF STYLESHEET
    ============================================================================ */
+
+/* =====================================================================
+   Section 26 — v1.5.1 security/UX additions
+   ===================================================================== */
+
+/* Visually hidden honeypot wrapper — off-screen, keyboard-skipped, bot-visible. */
+.ps-hp-wrap {
+	position: absolute;
+	left: -9999px;
+	top: auto;
+	width: 1px;
+	height: 1px;
+	overflow: hidden;
+	pointer-events: none;
+}
+
+/* Email verification banner on /profile */
+.ps-verify-required {
+	padding: var(--spacing-md);
+	margin-bottom: var(--spacing-lg);
+	border-left: 4px solid #F59E0B;
+	background-color: #FEF3C7;
+	color: #78350F;
+	border-radius: 6px;
+}
+
+html[data-theme="dark"] .ps-verify-required {
+	background-color: #451A03;
+	color: #FEF3C7;
+	border-left-color: #F59E0B;
+}
+
+.ps-verify-required h3 {
+	margin: 0 0 var(--spacing-xs) 0;
+	font-size: 1.05rem;
+}
+
+.ps-verify-resend {
+	margin-top: var(--spacing-sm);
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-sm);
+}
+
+.ps-verify-resend-status {
+	font-size: 0.9rem;
+	color: inherit;
+}
+
+/* Newsletter consent + privacy link */
+.ps-newsletter-consent {
+	display: flex;
+	align-items: flex-start;
+	gap: var(--spacing-xs);
+	margin-top: var(--spacing-sm);
+	font-size: 0.9rem;
+	line-height: 1.5;
+}
+
+.ps-newsletter-consent input[type="checkbox"] {
+	margin-top: 0.25em;
+	flex-shrink: 0;
+}
+
+.ps-newsletter-privacy {
+	margin-top: var(--spacing-xs);
+	font-size: 0.85rem;
+	opacity: 0.85;
+}
+
+/* Footer translations note */
+.footer-languages-note {
+	margin-top: var(--spacing-sm);
+	font-size: 0.85rem;
+	opacity: 0.7;
+}