Upgrade PHPStan to 2.x and raise analysis level from 6 to 10

- Bump phpstan/phpstan ^2.0 and szepeviktor/phpstan-wordpress ^2.0
- Move the analysis level into phpstan.neon (single source) and raise it to 10
- Add Val, a runtime coercion helper that narrows untyped WordPress boundary
  values (wpdb rows, REST params, superglobals, options) with explicit checks
  instead of blind casts, plus unit tests
- Type value-object fromRow() params as stdClass (what wpdb returns) and map
  columns through Val so unexpected shapes degrade safely
- Use %i identifier placeholders for table names in all wpdb::prepare() calls
  so every query string is a literal and identifiers are escaped by WordPress;
  raises the minimum WordPress version to 6.2 where %i was introduced
- Guard wpdb::prepare() null result before wpdb::query() in updateTax()
- Fix nullable get_permalink()/strtotime() handling, list types at REST and
  capability call sites, dead null-coalescing on checked superglobals, and
  narrow get_users() results before mapping
- Register Val method names with the ValidatedSanitizedInput sniff so it
  validates the real sanitizer around each superglobal read
- Update repository unit tests for the %i placeholder arguments

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Auth/StudentController.php

@@ -11,6 +11,7 @@ use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\BillingMethodResolver;
 use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Val;
 
 class StudentController {
 
@@ -28,7 +29,7 @@ class StudentController {
 		}
 
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only student selector.
-		$studentId = absint( $_GET['student_id'] ?? 0 );
+		$studentId = absint( Val::int( $_GET['student_id'] ?? 0 ) );
 		$student   = $studentId > 0 ? get_userdata( $studentId ) : false;
 
 		if ( $student && in_array( RoleManager::STUDENT, (array) $student->roles, true ) ) {
@@ -45,12 +46,15 @@ class StudentController {
 				'upcoming'   => $this->bookings->countUpcomingForStudent( (int) $user->ID ),
 				'enrolments' => $this->enrollments->countActiveForStudent( (int) $user->ID ),
 			],
-			get_users(
-				[
-					'role'    => RoleManager::STUDENT,
-					'orderby' => 'display_name',
-					'order'   => 'ASC',
-				]
+			array_filter(
+				get_users(
+					[
+						'role'    => RoleManager::STUDENT,
+						'orderby' => 'display_name',
+						'order'   => 'ASC',
+					]
+				),
+				static fn( mixed $user ): bool => $user instanceof \WP_User
 			)
 		);
 
@@ -63,7 +67,7 @@ class StudentController {
 
 		if ( $canBilling && isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_student_billing' ) ) {
 			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
-			$method = sanitize_key( wp_unslash( $_POST['payment_method'] ?? '' ) );
+			$method = sanitize_key( Val::string( wp_unslash( $_POST['payment_method'] ?? '' ) ) );
 			if ( in_array( $method, Payment::VALID_METHODS, true ) ) {
 				update_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, $method );
 			} else {
@@ -71,7 +75,7 @@ class StudentController {
 			}
 		}
 
-		$billingOverride = (string) get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true );
+		$billingOverride = Val::string( get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true ) );
 		$billingDefault  = $this->resolver->defaultMethod();
 
 		$now  = current_time( 'mysql' );