v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register

Security follow-up to v1.5.1. Closes four items from the v1.5.1 review —
two ship-blockers and two mediums — all within the ADR-0001 envelope.

PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP
only when REMOTE_ADDR falls inside a published Cloudflare edge range.
Previously, any direct-to-origin request (which Hostinger permits) could
forge its rate-limit key by setting the header to a different IP per
attempt, bypassing every abuse control in the theme. New module
inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a
CIDR matcher covering both families; list is overridable via the
peptide_starter_cloudflare_ip_ranges filter for out-of-band updates.
HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the
peptide_starter_trust_xff filter.

PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as
confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on
admin_init would have blocked wp-admin and hammered deliverability.
Existing accounts are now grandfathered: no ps_pending_verification
meta = verified. Verification applies only to registrations from v1.5.2
forward. The ps_verify_migration_version option (written by v1.5.1) is
cleared on theme activation.

PSEC-009 — Registration validation no longer short-circuits. All five
checks (username pattern, email validity, password length,
username_exists, email_exists) evaluate unconditionally before the
combined rejection. Closes the response-time oracle that let an
attacker distinguish microsecond-fast regex rejection from DB-round-trip
rejection and infer which field triggered the failure.

PSEC-010 — Added the happy-path verify test that v1.5.1 was missing.
Covers token match, user meta cleanup, auth cookie set, and the
peptide_starter_user_verified action firing with the correct user ID.

Seven new rate-limiter tests confirm CF-peer validation works
end-to-end: trusted CF peer honours the header, untrusted peer ignores
spoofed headers, invalid values fall through, XFF default-off, XFF
filter opt-in, CF range filter override, IPv6 CIDR match, family
mismatch rejection.

Confirmed with peptiderepo before coding: (1) Option A for PSEC-008
because zero users; (2) Cloudflare IS in front of the origin (dig
confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is
a real fix not dead code; (3) no staging — treat prod as staging.

ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md
documents the header-trust rules for future modules.

Version bumped to 1.5.2 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -30,8 +30,11 @@ peptide-starter/
 │   ├── helpers.php                # Nav walker + menu fallback, logo, getters,
 │   │                               # pagination, honeypot renderer, csv_safe,
 │   │                               # require_login gate, safe referer.
-│   ├── rate-limiter.php           # [v1.5.1] Peptide_Starter_Rate_Limiter +
-│   │                               # peptide_starter_get_client_ip (CF-aware).
+│   ├── cloudflare-ips.php         # [v1.5.2] CF edge range snapshot +
+│   │                               # CIDR matcher (v4 and v6).
+│   ├── rate-limiter.php           # Peptide_Starter_Rate_Limiter +
+│   │                               # peptide_starter_get_client_ip (peer-validated,
+│   │                               # PSEC-007).
 │   ├── email-verification.php     # [v1.5.1] Token send + verify route + resend
 │   │                               # endpoint + user_is_verified().
 │   ├── customizer.php             # Customizer sections/settings/controls.
@@ -220,19 +223,47 @@ Shortcodes (plugins), all wrapped in `shortcode_exists()`:
 
 - CSRF nonces on every form (auth, newsletter, contact, mail-test, unsubscribe).
 - Unified error messages on login + registration (no enumeration).
+- Registration validation does **not** short-circuit — all checks
+  evaluate unconditionally so response timing can't distinguish which
+  one failed (PSEC-009, v1.5.2).
 - Rate limiting on login / register / contact / newsletter / verify-resend.
 - Honeypots on the four public forms (login, register, contact, newsletter).
 - `require_login()` gate on every template that owns user data.
 - Email verification required for write access to user-data tools.
+- Existing accounts (created before v1.5.2) are grandfathered as
+  verified. Verification enforces only on registrations from v1.5.2
+  onward (PSEC-008, v1.5.2).
 - CSV export formula-injection safe.
 - All input sanitized at the boundary; all output escaped.
 - Login redirect validated with `wp_validate_redirect`.
 - Rate-limit storage keys are hashed — no raw IPs persisted.
 - Contact sender names reject header-injection characters before `wp_mail`.
 
+### Client-IP trust model (PSEC-007, v1.5.2)
+
+peptiderepo.com sits behind Cloudflare. The rate limiter keys on client
+IP, so the source of that IP matters for correctness of every abuse
+control in the theme.
+
+`peptide_starter_get_client_ip()` trusts in this priority order:
+
+1. **`HTTP_CF_CONNECTING_IP`** — only when `REMOTE_ADDR` is itself
+   inside a published Cloudflare edge range (see `inc/cloudflare-ips.php`).
+   Direct-to-origin connections that bypass Cloudflare cannot forge this
+   header because their peer IP is not a CF edge.
+2. **`HTTP_X_FORWARDED_FOR`** — ignored by default. Opt in via
+   `add_filter( 'peptide_starter_trust_xff', '__return_true' )` only
+   when a known, trusted non-CF proxy fronts the origin.
+3. **`REMOTE_ADDR`** — always trusted as the final fallback. Cannot be
+   client-controlled at the TCP layer.
+
+`inc/cloudflare-ips.php` holds a static snapshot of CF ranges. Refresh
+quarterly. Override via `peptide_starter_cloudflare_ip_ranges` filter
+for out-of-band updates.
+
 ## Version
 
-**Current:** v1.5.1 (2026-04-14)
+**Current:** v1.5.2 (2026-04-14)
 
 Bump `style.css` header line 7 and `PEPTIDE_STARTER_VERSION` in
 `functions.php` together on release.