Add bounded deep theme analysis

[matthewdorman]

Closes #4.

What changed

• Adds a bounded, read-only token_get_all(..., TOKEN_PARSE) inventory for active child and parent themes, reported separately.
• Recursively discovers contained PHP files, scans functions.php first, never follows symlinks, and documents excluded directories.
• Indexes fully-qualified declarations, LOC, literal includes, $wpdb evidence, and common hook, shortcode, REST, AJAX, cron, content, block, widget/sidebar, admin, and options APIs.
• Links quoted and Class::class callbacks only when an exact declaration is present in the same attributed theme. Dynamic callbacks and includes remain unresolved.
• Uses API-specific name and callback positions: cron reports its hook, REST combines namespace/route, and non-callback API arguments never become fake callback metadata.
• Ignores object/static method calls and function declarations whose names happen to match WordPress APIs.
• Adds descriptive-only monolithic functions.php evidence; size/responsibility is not labeled a vulnerability.
• Reports parse failures, skipped files, traversal/read errors, and reached limits instead of implying complete coverage.
• Adds admin UI and spreadsheet-safe CSV rows, a 15-minute version/theme-keyed cache, documentation, release packaging, and version 0.3.0.

Safety and bounds

Theme code is never included, required, evaluated, instantiated, or executed. The scanner is capped at 1,000 PHP files across both themes, 1 MiB per file, 10 MiB total source, and eight seconds. .git, node_modules, vendor, dist, build, cache, symlinks, and paths outside the resolved theme root are excluded and surfaced in coverage.

Scoped limitations

• This is token inventory, not a full AST. Files that fail PHP parsing are reported as incomplete coverage and are not partially inventoried.
• Only literal strings and supported literal array callbacks are candidates for linking. Variables, concatenation, closures, invokable objects, service containers, runtime autoload maps, and computed registrations remain unresolved rather than guessed.
• Bundled framework/library ownership is represented by theme role and relative path; copied-plugin provenance is not inferred without evidence.
• Cache results may be up to 15 minutes old; changing the active theme, theme version, analyzer version, or cache expiry triggers a fresh scan.

Validation

• Core and theme fixture tests pass.
• All 14 PHP files lint successfully.
• WordPress PHPCS passes for production source (the installed standard emits only its upstream deprecated-sniff notice).
• Release ZIP builds and validates.
• git diff --check passes.

Fixtures cover class-heavy and monolithic themes, fully-qualified static callback links including ::class, parent/child attribution, API-specific arguments, method/declaration false-positive prevention, literal and dynamic callbacks/includes, malformed input, excluded directories, symlinks, oversize files, database API evidence, and descriptive signals.