v0.2.3 — UI-editable encrypted provider API key (#6)

Squash-merge PR #6: PR Vision v0.2.3 — UI-editable encrypted provider API key

QA APPROVED: 2026-06-14-85956da7c86bed2c9e2cf60625fda0cf2e9518bb.md
All 5 CI checks green on head SHA 85956da7c8

CHANGELOG.md

@@ -7,6 +7,66 @@ Versioning: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [0.2.3] — 2026-06-15
+
+UI-editable provider API key: encrypted at rest, write-only, wp-config precedence.
+Output-escaping hardening in key manager renderer (`esc_url`/`esc_attr`/literal-conditional on all echoed values).
+
+### Added
+
+- **`PRV_Key_Store`** (`includes/core/class-prv-key-store.php`): single key resolver with
+  precedence chain — `PRV_OPENROUTER_API_KEY` constant → encrypted admin option `prv_provider_key_enc` → none.
+  `get_key()` is the sole key-access point for all probe and test paths.
+- **`PRV_Crypto_Helper`** (`includes/core/class-prv-crypto-helper.php`): low-level
+  symmetric encryption/decryption. Prefers libsodium `sodium_crypto_secretbox`
+  (XSalsa20-Poly1305); falls back to OpenSSL AES-256-GCM. Encryption key is derived
+  from WP salts (`AUTH_KEY` + `SECURE_AUTH_KEY`) via SHA-256 — environment-specific,
+  never stored. Storage format: `hex(nonce):hex(ciphertext)`.
+- **`PRV_Key_Manager_Renderer`** (`includes/core/class-prv-key-manager-renderer.php`):
+  renders the write-only "Provider API Key" card in Settings. Shows source status only
+  ("Set via wp-config (takes precedence)" / "Set via admin" / "Not set") plus last-run
+  health. Password input always renders empty. Constant defined → input disabled with note.
+- **`PRV_Key_Test_Ajax`** (`includes/core/class-prv-key-test-ajax.php`): AJAX handler for
+  the "Test key" button. Resolves key via `PRV_Key_Store::get_key()`, runs one cheap probe,
+  reports valid/invalid with `aria-live` result; key never in response.
+- **Key set/remove POST actions** in `PRV_Settings_Controller`:
+  `handle_key_set()` (encrypts + stores; empty input = no-op) and `handle_key_remove()`.
+- **`prv_key_set`, `prv_key_remove`, `prv_key_error`** notices in `PRV_Settings_Renderer`.
+- **`wp_ajax_prv_test_key`** hook registered in `PRV_Settings_Page` → dispatches to `PRV_Key_Test_Ajax`.
+- **Tests** (`tests/unit/test-key-store.php`): encrypt↔decrypt round-trip, wrong-key fails
+  silently, resolver precedence (constant > option > none), write-only render emits no key,
+  Remove clears option, constant takes precedence.
+
+### Changed
+
+- **`PRV_OpenRouter_Provider`**: removed direct `PRV_OPENROUTER_API_KEY` constant reads;
+  `probe()` now calls `PRV_Key_Store::get_key()`. New `probe_with_key(string $q, string $key)`
+  method for the test path (PRV_Key_Test_Ajax injects the resolved key). `is_configured()`
+  now checks `PRV_Key_Store::get_key() !== ''`.
+- **`PRV_Perplexity_Provider`**: same key-resolver migration — `probe()` calls `PRV_Key_Store::get_key()`.
+  `is_configured()` checks the store. Direct constant reads removed.
+- **`PRV_Model_Test_Ajax`**: resolves key via `PRV_Key_Store::get_key()` instead of checking
+  the constant directly. Returns a specific "key not configured — set via Settings" message
+  when no key is available.
+- **`PRV_Settings_Renderer`**: replaced read-only `render_api_key_status()` with a call to
+  `PRV_Key_Manager_Renderer::render()`. Added key-action notices. Provider API Key card is
+  now separate from the Probe Configuration form.
+- **`PRV_Settings_Page`**: added `NONCE_KEY` + `NONCE_KEY_TEST` constants; registered
+  `admin_post_prv_key_set`, `admin_post_prv_key_remove`, `wp_ajax_prv_test_key`.
+- **`uninstall.php`**: updated comment to explicitly list `prv_provider_key_enc` as a v0.2.3
+  addition purged by the `prv_` wildcard DELETE.
+- **`tests/unit/test-uninstall.php`**: seeds + asserts `prv_provider_key_enc` purge.
+
+### Security
+
+- Plaintext API key never stored in any option, transient, log, or echoed to the browser.
+- The encrypted option (`prv_provider_key_enc`) is ciphertext only; decryption is server-side
+  at probe time only. The encryption key is derived from WP salts — not stored.
+- `manage_options` + nonce required for all key actions (set, remove, test).
+- `wp-config` constant always takes precedence; admin path is only active when absent.
+
+---
+
 ## [0.2.2] — 2026-06-14
 
 Kill white WP admin gutters around the dark "Assay" UI — CSS only, no logic change.