v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

template-parts/newsletter-signup.php

@@ -2,16 +2,16 @@
 /**
  * Template Part: Newsletter Signup
  *
- * Reusable newsletter signup section displayed on front page and science feed.
- * Stores emails in wp_options as a placeholder until Mailchimp/similar is integrated.
+ * Reusable "Monthly Research Dispatch" CTA with consent checkbox and honeypot.
+ * Success and duplicate states are merged into a single "ok" message to
+ * avoid leaking subscription status of any address.
  *
- * @see functions.php — peptide_starter_handle_newsletter_signup() for form processing
- * @see front-page.php — includes this template part
- * @see page-science-feed.php — includes this template part
+ * @see functions.php — peptide_starter_handle_newsletter_signup()
+ * @see inc/helpers.php — peptide_starter_render_honeypot()
  *
- * What: Renders the "Monthly Research Dispatch" email signup form.
+ * What: Renders the newsletter signup form.
  * Who calls it: get_template_part( 'template-parts/newsletter', 'signup' ).
- * Dependencies: None — self-contained HTML form.
+ * Dependencies: None — self-contained form.
  *
  * @package peptide-starter
  */
@@ -21,21 +21,21 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 
-// Check for newsletter submission status messages.
-$newsletter_status  = isset( $_GET['ps_newsletter'] ) ? sanitize_text_field( wp_unslash( $_GET['ps_newsletter'] ) ) : '';
-$status_message     = '';
-$status_class       = '';
+$newsletter_status = isset( $_GET['ps_newsletter'] ) ? sanitize_text_field( wp_unslash( $_GET['ps_newsletter'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+$status_message    = '';
+$status_class      = '';
 
-if ( 'success' === $newsletter_status ) {
-	$status_message = __( 'Thanks for subscribing! You will receive our next dispatch.', 'peptide-starter' );
+// Unified "ok" state merges the old success + duplicate — do not leak
+// whether the address was already subscribed (abuse signal).
+if ( 'ok' === $newsletter_status ) {
+	$status_message = __( 'Thanks — if this is your first subscription, you will receive our next dispatch.', 'peptide-starter' );
 	$status_class   = 'ps-alert-success';
 } elseif ( 'invalid' === $newsletter_status ) {
-	$status_message = __( 'Please enter a valid email address.', 'peptide-starter' );
+	$status_message = __( 'Please enter a valid email address and agree to receive updates.', 'peptide-starter' );
 	$status_class   = 'ps-alert-error';
-} elseif ( 'duplicate' === $newsletter_status ) {
-	$status_message = __( 'This email is already subscribed.', 'peptide-starter' );
-	$status_class   = 'ps-alert-info';
 }
+
+$privacy_url = function_exists( 'get_privacy_policy_url' ) ? get_privacy_policy_url() : home_url( '/privacy' );
 ?>
 
 <section class="ps-newsletter-section">
@@ -57,6 +57,8 @@ if ( 'success' === $newsletter_status ) {
 			<form class="ps-newsletter-form" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post">
 				<?php wp_nonce_field( 'peptide_starter_newsletter', 'ps_newsletter_nonce' ); ?>
 				<input type="hidden" name="action" value="peptide_starter_newsletter_signup">
+				<?php peptide_starter_render_honeypot( 'newsletter' ); ?>
+
 				<div class="ps-newsletter-form-row">
 					<input
 						type="email"
@@ -70,6 +72,19 @@ if ( 'success' === $newsletter_status ) {
 						<?php esc_html_e( 'Subscribe', 'peptide-starter' ); ?>
 					</button>
 				</div>
+
+				<label class="ps-newsletter-consent">
+					<input type="checkbox" name="ps_consent" value="1" required>
+					<span>
+						<?php esc_html_e( 'I agree to receive occasional research updates. Unsubscribe anytime.', 'peptide-starter' ); ?>
+					</span>
+				</label>
+
+				<p class="ps-newsletter-privacy">
+					<a href="<?php echo esc_url( $privacy_url ); ?>" rel="noopener">
+						<?php esc_html_e( 'Privacy policy', 'peptide-starter' ); ?>
+					</a>
+				</p>
 			</form>
 
 			<p class="ps-newsletter-learn-more">