v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test-email-verification.php

@@ -0,0 +1,103 @@
+<?php
+/**
+ * Tests for inc/email-verification.php.
+ *
+ * @package peptide-starter
+ */
+
+class Test_Email_Verification extends WP_UnitTestCase {
+
+	public function set_up() {
+		parent::set_up();
+		// Capture wp_mail without sending.
+		add_filter(
+			'pre_wp_mail',
+			function () {
+				return true;
+			}
+		);
+	}
+
+	public function tear_down() {
+		remove_all_filters( 'pre_wp_mail' );
+		parent::tear_down();
+	}
+
+	public function test_send_sets_meta_and_returns_true() {
+		$user_id = self::factory()->user->create();
+		$sent    = peptide_starter_send_verification_email( $user_id );
+
+		$this->assertTrue( $sent );
+		$this->assertSame( '1', (string) get_user_meta( $user_id, 'ps_pending_verification', true ) );
+		$this->assertNotEmpty( get_user_meta( $user_id, 'ps_verify_token', true ) );
+		$this->assertGreaterThan( time(), (int) get_user_meta( $user_id, 'ps_verify_expires', true ) );
+	}
+
+	public function test_user_is_verified_default_without_meta() {
+		$user_id = self::factory()->user->create();
+		$this->assertTrue( peptide_starter_user_is_verified( $user_id ) );
+	}
+
+	public function test_user_is_unverified_with_pending_meta() {
+		$user_id = self::factory()->user->create();
+		update_user_meta( $user_id, 'ps_pending_verification', 1 );
+		$this->assertFalse( peptide_starter_user_is_verified( $user_id ) );
+	}
+
+	public function test_verification_handler_rejects_bad_token() {
+		$user_id = self::factory()->user->create();
+		peptide_starter_send_verification_email( $user_id );
+
+		$_GET['uid']   = $user_id;
+		$_GET['token'] = 'obviously-wrong';
+		set_query_var( 'ps_verify', 1 );
+
+		$redirected = null;
+		add_filter(
+			'wp_redirect',
+			function ( $url ) use ( &$redirected ) {
+				$redirected = $url;
+				return false;
+			}
+		);
+
+		try {
+			peptide_starter_handle_verify_request();
+		} catch ( Exception $e ) { /* wp_safe_redirect + exit */ }
+
+		$this->assertNotNull( $redirected );
+		$this->assertStringContainsString( 'verify_error=1', (string) $redirected );
+		remove_all_filters( 'wp_redirect' );
+		set_query_var( 'ps_verify', 0 );
+	}
+
+	public function test_verification_handler_rejects_expired_token() {
+		$user_id = self::factory()->user->create();
+		$token   = wp_generate_password( 43, false, false );
+		update_user_meta( $user_id, 'ps_pending_verification', 1 );
+		update_user_meta( $user_id, 'ps_verify_token', $token );
+		update_user_meta( $user_id, 'ps_verify_expires', time() - 10 );
+
+		$_GET['uid']   = $user_id;
+		$_GET['token'] = $token;
+		set_query_var( 'ps_verify', 1 );
+
+		$redirected = null;
+		add_filter(
+			'wp_redirect',
+			function ( $url ) use ( &$redirected ) {
+				$redirected = $url;
+				return false;
+			}
+		);
+
+		try {
+			peptide_starter_handle_verify_request();
+		} catch ( Exception $e ) { /* ok */ }
+
+		$this->assertNotNull( $redirected );
+		$this->assertStringContainsString( 'verify_error=1', (string) $redirected );
+		remove_all_filters( 'wp_redirect' );
+		set_query_var( 'ps_verify', 0 );
+	}
+}