fix: address WordPress.org plugin review round 1 (v2.2.3)

[cport1]

Fixes every actionable item from the WordPress.org plugin review (Review ID: AUTOPREREVIEW webdecoy/webdecoy1/21Jul26).

Flagged items and fixes

1. Use wp_enqueue commands (challenge-page.php:28/195, block-page.php:35, statistics-page.php:248)

• The challenge/block pages are standalone interstitials served before the theme renders (exit after include), so wp_enqueue_scripts never fires there. They now use the WordPress dependency APIs directly: wp_register_style + wp_print_styles([handle]) in head and wp_register_script + wp_add_inline_script (per-request config/i18n) + wp_print_scripts([handle]) before </body>, with the CSS/JS extracted to static files:
  • public/css/webdecoy-challenge.css, public/css/webdecoy-block.css
  • public/js/webdecoy-challenge.js (reads webdecoyChallengeConfig global)
• Statistics page chart data now attaches to the footer-enqueued webdecoy-charts handle via wp_add_inline_script(..., 'before') — no raw <script> tag.

2. Powered by / credit links (guideline 10)

• The 'Protected by WebDecoy' link on the challenge page is now an explicit admin opt-in: new Settings → Blocking → Challenge Page Credit checkbox, off by default. New challenge_show_credit option (default false) with sanitizer.

3. Contributors list

• Contributors: webdecoy → webdecoy1 (the wp.org account that owns the submission).

4. Out-of-date Chart.js

• Bundled admin/js/vendor/chart.umd.min.js updated 4.4.9 → 4.5.1 (latest stable, from the official npm tarball). Enqueue version string and readme reference updated.

5. External services / GoodBotList URLs

• Those URLs (api.slack.com/robots etc.) are reference metadata in the good-bot database — never requested. Added a readme note under External Services stating this explicitly. The existing WebDecoy Cloud disclosure already covers what/when/where data is sent with ToS + privacy links.

6. load_plugin_textdomain()

• Removed (method + init hook). Min WP is 6.1, so it's unneeded for a directory-hosted plugin since 4.6.

7. Nonces & permissions

• Audited every $_GET/$_POST/$_REQUEST site: all state-changing paths already have check_ajax_referer/wp_verify_nonce + current_user_can (2.2.2 hardening). No changes needed.

Verification

• php -l clean on all changed files
• PHPCS: 0 errors on changed files (only pre-existing direct-DB warnings)
• PHPStan level 3: no errors on changed files
• Test suite: 41 passed, 0 failed
• ./build.sh 2.2.3 --org builds clean; zip contains the new assets, excludes self-updater/clearance client