Add AI Provider check to recommend the WordPress AI Client (#1341)

[developeritsme]

What?

Closes #1341

Adds a new static check (ai_provider) that warns when a plugin integrates directly with a third-party AI provider API instead of using the WordPress AI Client and Connectors infrastructure introduced in WordPress 7.0.

Why?

WordPress 7.0 provides a standard abstraction (wp_ai_client_prompt()) so site owners can configure an AI provider once and plugins can send prompts through whichever compatible provider is configured, without duplicating provider setup screens, API key fields, or credential storage. Direct provider integrations are not invalid, but the check helps authors discover and adopt the recommended path. As requested in the issue, this is a recommendation (warning), not a hard failure.

How?

• New tokenized PHPCS sniff PluginCheck.CodeAnalysis.AIProvider that inspects only string-literal tokens and requires an explicit http(s) scheme before a known provider host. This means mentions inside comments/docblocks, bare hostnames without a scheme, and unrelated URLs are intentionally not flagged, keeping false positives low.
• Known hosts covered: api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, api.x.ai, api.mistral.ai, api.cohere.ai, api.cohere.com, api.groq.com, api.perplexity.ai, api.deepseek.com, openrouter.ai.
• New AI_Provider_Check (Abstract_PHP_CodeSniffer_Check) registered under the general category in Default_Check_Repository, mirroring Offloading_Files_Check.
• The sniff emits a warning (DirectIntegration), not an error.
• Docs: added an entry to docs/checks.md.

A note on category: per the AGENTS.md definitions (CATEGORY_PLUGIN_REPO = directory requirements, CATEGORY_GENERAL = best practices), this recommendation is placed under general. Happy to move it if maintainers prefer plugin_repo.

Testing Instructions

1. cd phpcs-sniffs && composer install
2. Run the sniff unit tests: composer run-tests (or filter: vendor/bin/phpunit --filter AIProvider ./vendor/squizlabs/php_codesniffer/tests/AllTests.php --no-coverage).
3. Quick manual check against the bundled fixture:
   vendor/bin/phpcs --standard=PluginCheck --sniffs=PluginCheck.CodeAnalysis.AIProvider tests/phpunit/testdata/plugins/test-plugin-ai-provider-check-with-errors/load.php
   Expected: warnings on the two real integration lines only; the bare host and unrelated URL are not flagged.
4. Via WP-CLI on a plugin containing wp_remote_post( 'https://api.openai.com/v1/chat/completions', ... ):
   wp plugin check <slug> --checks=ai_provider

AI Usage Disclosure

• This PR was created without the help of AI tools
• This PR includes AI-assisted code or content

If AI tools were used, please describe how they were used:
Implemented with the assistance of Claude Code (Anthropic). The author reviewed and verified all changes, including running the sniff unit tests and PHPCS linting locally.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @MarkPra.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: MarkPra.

Co-authored-by: developeritsme <developeritsme@git.wordpress.org>
Co-authored-by: ernilambar <nilambar@git.wordpress.org>
Co-authored-by: davidperezgar <davidperez@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[davidperezgar]

Thanks @developeritsme !