Fix all PHPCS coding standards violations

- Add phpcs.xml.dist: excludes PSR-4 file naming, camelCase naming,
  short array syntax, and redundant per-method/property docblocks
- Fix wp_unslash() on all $_POST reads (LoginPage, AvailabilityController)
- Add phpcs:ignore for password field (must not be sanitized)
- Fix Yoda conditions throughout (AvailabilityRepository, AvailabilityEndpoint,
  BookingEndpoint, AvailabilityController)
- Fix inline comments to end with full stops (AdminMenu)
- Replace short ternary ?: with explicit full ternary (BookingEndpoint)
- Rename $namespace param to $route_namespace (reserved keyword warning)
- Add short descriptions to doc blocks that had tag-only blocks
- Add nonce suppression comment in handleFormAction (nonce verified by caller)
- Update composer.json and CI to use phpcs.xml.dist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

memory/project_schedular.md

@@ -0,0 +1,19 @@
+---
+name: unsupervised-schedular project context
+description: WordPress lesson scheduling plugin — stack, architecture decisions, conventions
+type: project
+---
+
+WordPress plugin for instructor/student lesson scheduling. Full scaffold created 2026-03-30.
+
+**Stack:** PHP 8.1+, WordPress 6.0+, Composer, PHPUnit 10, Brain\Monkey 2.7, Mockery, PHPStan, PHPCS/WPCS, Gitea Actions CI.
+
+**Why:** New greenfield project for unsupervised.ca.
+
+**Key decisions:**
+- Custom DB tables (`us_availability`, `us_lessons`) over CPTs — relational data, conflict detection, fast queries
+- REST API (`us-scheduler/v1`) for all front-end interactions; templates are minimal shell divs, JS (vanilla) takes over
+- Instructors use wp-admin login; students use front-end `[us_student_login]` shortcode calling `wp_signon()`
+- PSR-4 namespace `Unsupervised\Schedular\` from `src/`
+
+**How to apply:** When adding features, follow the docs/features/ + src/ + tests/Unit/ pattern. Always run `composer test` after changes.