Add PHPUnit integration tests and CI

[rafael-minuesa]

Adds a PHPUnit integration suite that runs the plugin inside the real WordPress test framework, plus a GitHub Actions workflow. No runtime code changes.

What is tested

64 tests. HTTP is faked with pre_http_request, so no test reaches a remote feed.

• Shortcode attributes and defaults: count, endpoint cleanup, source lookup, excerpt length.
• Endpoint validation: empty, malformed, non-http schemes, loopback, private network, credentials in the URL, unsafe port.
• Escaping of remote titles, authors, links, image attributes and excerpts.
• Transport errors, HTTP error statuses and invalid JSON, including that failures are not cached.
• Load More button, rendered only when x-wp-totalpages is above 1, with its stored token context.
• Load More AJAX handler, run through the real wp_ajax_nopriv_ and wp_ajax_ hooks with WordPress's AJAX die handler. Covers the next page for a valid token, page caching, has_more on the last page, malformed tokens and pages rejected before any HTTP request, unknown tokens reported as expired, a page past the last one returned as an error, and remote failures returned as escaped errors that are not cached. The handler has no nonce by design (page-cached HTML would carry an expired nonce), so the test checks that it works for logged-out visitors without one.

Mutation results

The original review broke the code by hand and confirmed the suite fails for each of these:

• escaping of remote output removed
• wp_safe_remote_get() swapped for wp_remote_get()
• endpoint URL validation removed
• count upper bound removed
• failed responses cached

The same check for the new Load More tests, one break at a time, restored afterwards:

Break	Result
Button never rendered when x-wp-totalpages > 1	14 failures of 64
Token and page validation removed	9 failures of 64
Fetch error returned with wp_send_json_success()	2 failures of 64

Before these tests, all three breaks passed the suite.

Running locally

See CONTRIBUTING.md. In short:

composer install
bash dev-tools/install-test-wordpress.sh 6.8
export WP_TESTS_DB_NAME=rpe_tests WP_TESTS_DB_USER=root WP_TESTS_DB_PASSWORD=... WP_TESTS_DB_HOST=127.0.0.1:3306
composer test
composer test:random

Use a disposable database. The test framework creates and drops tables in it.

CI

PHP 7.4 with WordPress 6.8, and PHP 8.3 and 8.4 with the latest WordPress, each against its own MySQL service. Composer downloads are cached, keyed on composer.lock. Push builds run on main only, so PR branches build once.

Known gaps

• excerpt_length="invalid" resolves to 0 (no limit) and count="-3" becomes 3. The tests lock in current behavior; this PR does not change it.
• The lowest WordPress version tested is 6.8, while the plugin header says Requires at least 5.3.
• No PHPCS in CI. The repo has no ruleset yet.