feat: one-click Cloud connect, digest consent, entitlements sync

[cport1]

What this does

Implements the WordPress side of one-click Cloud connect (#40) and the entitlements sync + Free Connected UI state (#41), per the authoritative connect API contract in both issues.

The flow (issue #40)

1. Connect click — In the WebDecoy Cloud settings tab, a primary Connect to WebDecoy Cloud button sits above a Send me a monthly security report consent checkbox (default unchecked). Clicking posts to admin-post.php (nonce-protected). The handler mints a 64-hex CSPRNG nonce, stores it in a 15-minute site transient, and redirects the browser to:

   https://app.webdecoy.com/connect/wordpress?site_url=…&site_name=…&nonce=<64-hex>&digest={0|1}&return_url=<enc admin URL>
   

2. Return handler — On the settings page return (?page=webdecoy&tab=cloud&wd_connect=1&wd_connect_token=…), the plugin verifies manage_options + that the stored transient nonce still exists, then server-side wp_remote_posts the token to https://api.webdecoy.com/api/v1/connect/wordpress/exchange with {connect_token, site_url, nonce}. On 200 it persists api_key, site_key, organization_id, organization_name, plan, burns the transient, and shows a success notice. Denial (wd_connect_error=denied) or any error surfaces a clean notice with no state change.
3. New class includes/class-webdecoy-cloud-connect.php owns the whole flow, wired into webdecoy.php beside the sibling feature classes.

The manual API key / site key fields are unchanged — they just move into a collapsed Advanced: manual configuration <details> fold.

Entitlements + connected UI (issue #41)

• Sync — After a successful connect and then twice daily via cron (webdecoy_sync_entitlements), the plugin GETs https://ingest.webdecoy.com/api/v1/sdk/entitlements authenticated exactly like the violation reporter — the API key as an Authorization: Bearer <api_key> header. The normalized response is cached in the webdecoy_entitlements option with a fetched_at stamp; entries older than 12h are flagged stale but still served; any error fails open to free (all features false).
• Accessor — WebDecoy_Cloud_Connect::get_entitlements() always returns a complete, typed array.
• Connected UI — org name, plan badge (Free Connected for free_connected, else the humanized plan name), monthly-report status line, Upgrade link to https://app.webdecoy.com/billing, and a nonce-protected Disconnect button that clears keys/entitlements/org locally (no remote call, per P0).

Zero-external-calls guarantee

The reviewed 2.2.3 property holds: no external HTTP call happens until the user clicks Connect. On a fresh/unconnected install, handle_connect never fires, the return handler returns early, the entitlements cron is never scheduled, and sync_entitlements bails when no API key is present. The exchange POST and entitlements GET only ever run after an explicit, user-initiated connect.

Notes

• PHP 7.4-safe (no 8.0+ syntax); class constants use literals so the file loads without WP constants (enables dependency-free tests).
• Plugin Check clean: all input sanitized/unslashed, actions nonce-verified, output escaped; phpcs.xml.dist security ruleset and phpstan (level 3) both pass on touched files with zero new errors. No inline <style>/<script> — styling lives in the enqueued admin stylesheet.
• Connect/disconnect use two standalone forms outside the settings form (no nested forms); the tab controls target them via the HTML5 form="" attribute.

Tests

tests/CloudConnectTest.php added to the dependency-free suite (php tests/run.php, now 48 passed, 0 failed): entitlements normalization (fail-open, feature coercion, 12h staleness boundary, garbage-shape safety), is_hex nonce validation, connect-token sanitization + length cap, and plan labelling.

Closes #40, Closes #41. Part of WebDecoy/app#306.