test: add phpunit harness with characterization tests

[YvesCesar]

The plugin had no tests. This adds the PHPUnit harness and a characterization suite over the current behaviour, on top of the static analysis setup from #9 (hence the base branch; it retargets to main once #9 is merged).

Harness

• composer test is all it takes. composer install pulls WordPress itself (roots/wordpress, installed into vendor/wordpress) and the core test suite (wp-phpunit), so the only external requirement is a MySQL/MariaDB server with a database the suite may wipe.
• tests/wp-tests-config.php reads everything from the environment (WP_TESTS_DB_*, WP_CORE_DIR), defaulting to the local stack.
• No test reaches the network: tests/bootstrap.php answers any unexpected HTTP request with a WP_Error, and tests that exercise an outgoing call answer it through tests/Support/FakeHttp.php, which uses WordPress' own pre_http_request filter instead of a mock object.
• CI is split by responsibility: tests.yml runs PHPUnit on PHP 8.1 and 8.3 against a MariaDB service, and code-quality.yml keeps one job per check — lint, coding-standards and static-analysis — so a failure names the tool that failed. The ci Composer script still chains all four locally.
• PHPStan now analyses tests/ as well, with phpstan/phpstan-phpunit — among other things it validates the @dataProvider references. The ignoreErrors entry for the salts is gone, since tests/wp-tests-config.php defines them.

Tests

143 tests. tests/ mirrors the plugin file by file with Test.php appended: a file goes to Unit/ when it only feeds values to a function and reads the returned value, and to Integration/ when it goes through WordPress — options, hooks, the REST server or the database.

• GitHub webhook — HMAC signature, user agent, production deploy detection, delivery deduplication, and the REST endpoint end to end: missing secret, wrong client, bad signature, ping, unsupported event, unparsable payload, ignored runs, successful sync and a failing origin.
• Fragment sync — origin normalization, fetching, empty body, transport error, stored metadata, partial and total failure.
• Account navigation — menu order and labels, hook registration, endpoint titles and the highlighting of detail screens.
• Main file — deploy dispatch on publish, the version route, the noindex tag, the Nextcloud public host, the rewrite version, the author exposed with a gravatar hash and the encrypted settings storage.

Two current behaviours are locked in as they are, each with the reason in the test docblock:

• update_option() sanitizes the value and, when the option does not exist yet, hands it to add_option(), which sanitizes it again. The deploy token and the webhook secret are therefore encrypted twice on the first save and only work from the second one on.
• In libresign_trigger_github_action_on_publish(), && binds tighter than ||, so publishing any post type dispatches a site deploy; the post type is only considered when published content leaves the publish status.

WooCommerce is not installed in the suite, so what only exists with it loaded — the root account endpoints, the invoice title, the addresses redirect and the subscription change confirmation — is still uncovered.

Verification

composer ci is green: lint, PHPCS, PHPStan level 5 including tests/, and 143 tests passing.

[vitormattos]

The test suite is going in a good direction.

I like the separation between Unit and Integration, the use of the real WordPress REST server in integration tests, and blocking unexpected external HTTP requests.

I left some comments before merging:

• one workflow file per tool;
• make Unit tests really independent from the WordPress bootstrap and database;
• declare only the WordPress versions we are really testing and supporting;
• when we find a known bug, add a regression test for the correct behavior and fix the bug instead of adding a green characterization test for the wrong behavior.

After these changes I think the test foundation will be much clearer and safer to extend.

[vitormattos]

The previous review points are resolved and the CI is green.

I also reviewed the PHP version handling. There is still some duplicated compatibility configuration, but it is not causing a problem in the current PR, so I opened #15 as a follow-up to make composer.json the single source of truth for supported PHP versions.

This PR looks good to merge.