Better storing of credentials for hosting providers (#333)

* Better storing of credentials for hosting providers

* Refactor hosting integrations into modular provider architecture

Replace monolithic host provider classes with a modular integration system
using capability interfaces (domain mapping, domain selling, email selling,
multi-tenancy). Add DNS diagnostics to domain manager, MCP adapter updates,
and comprehensive test coverage for the new provider architecture.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix credential encryption to use fixed-length IV instead of delimiter

The previous encrypt/decrypt flow used '::' as a delimiter between the
raw IV and ciphertext, which could break if the random IV bytes happened
to contain '::'. Now the raw IV is concatenated directly before the
ciphertext and sliced by its known fixed length on decryption.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix save_credentials to use empty-string defaults instead of numeric keys

array_flip() on the constants list produced numeric values (0, 1, ...)
which passed the non-empty check and got encrypted/stored. Replaced with
array_fill_keys() so missing keys default to empty strings, ensuring
only genuinely provided values are encrypted and stored.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix PHP injection vulnerability in get_constants_string

Credential values were interpolated directly into define() statements
via sprintf, allowing values containing single quotes to break out of
the string and inject arbitrary PHP. Now uses var_export() to produce
safely-escaped PHP literals for both the constant name and value. Also
fixes the same array_flip() numeric-defaults issue as save_credentials.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: superdav42

assets/js/webhook-list-page.min.js

@@ -33,8 +33,8 @@
         "php": ">=7.4.1",
         "automattic/jetpack-autoloader": "^5.0.0",
         "wp-ultimo/autoloader-plugin": "dev-main",
-        "wordpress/abilities-api": "^0.1.1",
-        "wordpress/mcp-adapter": "dev-trunk#7a2d22cff92328bc94f5b1648a66ae4273e949c5",
+        "wordpress/abilities-api": "^0.4.0",
+        "wordpress/mcp-adapter": "^0.4.1",
         "rpnzl/arrch": "dev-master#994258bbefb7722243211654c4f78813312cd5ed",
         "amphp/amp": "^2.6.2",
         "amphp/byte-stream": "^1.8.1",