feat(images): retry Cloudflare NSFW-blocked prompts with a sanitized fallback

Cloudflare's Workers AI FLUX.1 schnell content filter sometimes rejects
peptide-comic prompts as NSFW (HTTP 400, errors[].code === 3030). On
2026-04-20 this produced a silent publish-without-featured-image for
post #650 ("Semaglutide vs Tirzepatide") — the LLM-rewritten scene
tripped the filter and we had no recovery path.

New behaviour: on a 3030 response, the Cloudflare provider throws a
typed PRAutoBlogger_Image_NSFW_Blocked exception. The batch wrapper
catches it and tags the per-slot result with
`error_type: nsfw_blocked`. Image_Pipeline hands the results to a new
PRAutoBlogger_Image_NSFW_Retry helper, which reruns the blocked slot
once with a sanitized fallback prompt (title + style suffix, no LLM
rewrite). On success the retry result replaces the error entry; on a
second block, a WARNING is logged and the pipeline publishes without
that image — same terminal behaviour we had before, just explicit.

Files:

- New providers/class-image-nsfw-blocked.php — typed exception.
- providers/class-cloudflare-image-support.php — is_nsfw_error() +
  throw_if_nsfw() helpers.
- providers/class-cloudflare-image-provider.php — calls throw_if_nsfw
  inside the 4xx branch; batch catches the typed exception and marks
  the result with error_type.
- core/class-image-prompt-builder.php — new public build_fallback_prompt
  shim so the retry layer can reach the rule-based fallback without
  going through the LLM path.
- New core/class-image-nsfw-retry.php — single-shot retry helper.
- core/class-image-pipeline.php — invokes the retry between batch
  completion and per-slot processing.
- admin/class-settings-fields-extended.php — new toggle
  `prautoblogger_image_nsfw_retry` (default on) in the Images section.

Tests:

- CloudflareImageProviderTest — 3030 response throws NSFW exception;
  batch tags the per-slot result with `error_type: nsfw_blocked`.
- ImagePipelineTest — retry succeeds when provider returns a good
  result on the second call; retry is skipped when the setting is off.

Cost impact: worst-case an extra Cloudflare call per NSFW-blocked slot
(~$0.000834). Current incidence ~2% of generations; ~+$0.00002 per
generation amortized. Immaterial.

Uninstall: new option covered by the existing prautoblogger_% LIKE
sweep in uninstall.php.

Part of the v0.8.0 image bundle (issues from thread image-mime-bug).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/Providers/CloudflareImageProviderTest.php

@@ -189,6 +189,57 @@ class CloudflareImageProviderTest extends BaseTestCase {
 		}
 	}
 
+	/**
+	 * A 400 carrying Cloudflare's NSFW code (3030) must throw the typed
+	 * PRAutoBlogger_Image_NSFW_Blocked exception, not a generic
+	 * RuntimeException. Image_NSFW_Retry keys off the typed exception to
+	 * decide whether to rebuild the prompt and retry.
+	 */
+	public function test_generate_image_throws_nsfw_blocked_on_code_3030(): void {
+		$this->with_token( 'test-token' );
+
+		$nsfw_body = '{"errors":[{"message":"AiError: Input prompt contains NSFW content.","code":3030}]}';
+
+		Functions\when( 'wp_remote_post' )->justReturn( [
+			'body'     => $nsfw_body,
+			'response' => [ 'code' => 400 ],
+			'headers'  => [],
+		] );
+		Functions\when( 'wp_remote_retrieve_response_code' )->justReturn( 400 );
+		Functions\when( 'wp_remote_retrieve_body' )->justReturn( $nsfw_body );
+
+		$provider = new \PRAutoBlogger_Cloudflare_Image_Provider();
+		$this->expectException( \PRAutoBlogger_Image_NSFW_Blocked::class );
+		$provider->generate_image( 'some peptide prompt', 1080, 1080 );
+	}
+
+	/**
+	 * A non-3030 4xx (e.g. 401 bad token) must NOT be tagged NSFW — the
+	 * retry path would be wasted work there.
+	 */
+	public function test_generate_image_batch_tags_nsfw_errors_distinctly(): void {
+		$this->with_token( 'test-token' );
+
+		$nsfw_body = '{"errors":[{"message":"AiError: Input prompt contains NSFW content.","code":3030}]}';
+
+		Functions\when( 'wp_remote_post' )->justReturn( [
+			'body'     => $nsfw_body,
+			'response' => [ 'code' => 400 ],
+			'headers'  => [],
+		] );
+		Functions\when( 'wp_remote_retrieve_response_code' )->justReturn( 400 );
+		Functions\when( 'wp_remote_retrieve_body' )->justReturn( $nsfw_body );
+
+		$provider = new \PRAutoBlogger_Cloudflare_Image_Provider();
+		$results  = $provider->generate_image_batch( [
+			'image_a' => [ 'prompt' => 'some prompt', 'width' => 1080, 'height' => 1080 ],
+		] );
+
+		$this->assertArrayHasKey( 'image_a', $results );
+		$this->assertSame( 'nsfw_blocked', $results['image_a']['error_type'] ?? null );
+		$this->assertArrayHasKey( 'error', $results['image_a'] );
+	}
+
 	/**
 	 * Response shape must be one of: image/* bytes OR JSON envelope with
 	 * base64 image. Anything else is a contract breach — fail loudly.