Upgrade PHPStan to 2.x and raise analysis level from 6 to 10

- Bump phpstan/phpstan ^2.0 and szepeviktor/phpstan-wordpress ^2.0
- Move the analysis level into phpstan.neon (single source) and raise it to 10
- Add Val, a runtime coercion helper that narrows untyped WordPress boundary
  values (wpdb rows, REST params, superglobals, options) with explicit checks
  instead of blind casts, plus unit tests
- Type value-object fromRow() params as stdClass (what wpdb returns) and map
  columns through Val so unexpected shapes degrade safely
- Use %i identifier placeholders for table names in all wpdb::prepare() calls
  so every query string is a literal and identifiers are escaped by WordPress;
  raises the minimum WordPress version to 6.2 where %i was introduced
- Guard wpdb::prepare() null result before wpdb::query() in updateTax()
- Fix nullable get_permalink()/strtotime() handling, list types at REST and
  capability call sites, dead null-coalescing on checked superglobals, and
  narrow get_users() results before mapping
- Register Val method names with the ValidatedSanitizedInput sniff so it
  validates the real sanitizer around each superglobal read
- Update repository unit tests for the %i placeholder arguments

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Policy/PolicyController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\Policy;
 
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Val;
 
 class PolicyController {
 
@@ -23,7 +24,7 @@ class PolicyController {
 		}
 
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only policy selector.
-		$policyId       = absint( $_GET['policy_id'] ?? 0 );
+		$policyId       = absint( Val::int( $_GET['policy_id'] ?? 0 ) );
 		$policyList     = $this->policies->findAll();
 		$selectedPolicy = $policyId > 0 ? $this->policies->findById( $policyId ) : null;
 		$policyVersions = null !== $selectedPolicy ? $this->versions->findByPolicy( (int) $selectedPolicy->id ) : null;
@@ -34,13 +35,13 @@ class PolicyController {
 	private function handleFormAction(): void {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
-		$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
 
 		if ( 'create_policy' === $action ) {
-			$title   = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) );
-			$slugRaw = sanitize_text_field( wp_unslash( $_POST['slug'] ?? '' ) );
+			$title   = sanitize_text_field( Val::string( wp_unslash( $_POST['title'] ?? '' ) ) );
+			$slugRaw = sanitize_text_field( Val::string( wp_unslash( $_POST['slug'] ?? '' ) ) );
 			$slug    = sanitize_title( '' !== $slugRaw ? $slugRaw : $title );
-			$scope   = sanitize_key( wp_unslash( $_POST['acceptance_scope'] ?? Policy::SCOPE_BOOKING ) );
+			$scope   = sanitize_key( Val::string( wp_unslash( $_POST['acceptance_scope'] ?? Policy::SCOPE_BOOKING ) ) );
 
 			if ( ! in_array( $scope, Policy::VALID_SCOPES, true ) ) {
 				$scope = Policy::SCOPE_BOOKING;
@@ -53,18 +54,18 @@ class PolicyController {
 			return;
 		}
 
-		$policyId = absint( $_POST['policy_id'] ?? 0 );
+		$policyId = absint( Val::int( $_POST['policy_id'] ?? 0 ) );
 		if ( $policyId <= 0 || null === $this->policies->findById( $policyId ) ) {
 			return;
 		}
 
 		if ( 'add_version' === $action ) {
-			$body = wp_kses_post( wp_unslash( $_POST['body'] ?? '' ) );
+			$body = wp_kses_post( Val::string( wp_unslash( $_POST['body'] ?? '' ) ) );
 			$this->service->addDraftVersion( $policyId, $body );
 		}
 
 		if ( 'publish_version' === $action ) {
-			$versionId = absint( $_POST['version_id'] ?? 0 );
+			$versionId = absint( Val::int( $_POST['version_id'] ?? 0 ) );
 			if ( $versionId > 0 ) {
 				$this->service->publishVersion( $policyId, $versionId );
 			}