security: trusted-proxy rate limiting, atomic restore, encrypted webhook secret

[altugank]

Follow-ups from the live security review. Each change was verified against a real WordPress 7.0 / PHP 8.2 install (code-level harness + live HTTP).

1. Trusted-proxy client IP for rate limiting

The webhook rate limiter keyed on REMOTE_ADDR, so behind a CDN/reverse proxy every visitor shared one bucket.

• New WP_Puller_Client_IP resolves the real client IP. Forwarding headers (CF-Connecting-IP, True-Client-IP, X-Forwarded-For) are trusted only when REMOTE_ADDR is itself a trusted proxy — so a direct attacker can't spoof them to dodge the limiter.
• Cloudflare supported out of the box (ranges fetched weekly via wp_safe_remote_get + hard-coded fallback). Loopback/RFC1918 covered for a site's own nginx/HAProxy.
• Extensible to Sucuri / Akamai / custom LBs via wp_puller_trusted_proxies and wp_puller_client_ip_headers filters. Full IPv4 + IPv6 CIDR matching.

Verified: spoofed X-Forwarded-For/CF-Connecting-IP from an untrusted source is ignored; Cloudflare/Akamai/private-proxy paths resolve correctly; rate limiter buckets per real client and can't be split by header spoofing.

2. Atomic theme restore

restore_backup() deleted the live theme before copying the backup — a mid-copy failure left the site themeless.

• Now stages the restored copy in a dot-prefixed sibling dir (ignored by the theme scanner), then swaps via fast rename()s with rollback.

Verified: happy path restores correctly; a forced failure (read-only parent) returns a WP_Error with the live theme fully intact and no leftover temp dirs.

3. Webhook secret encrypted at rest

Per review finding #1, but using the WordPress-idiomatic mechanism rather than anything custom: the existing salt-derived WP_Puller::encrypt() (same as the GitHub PAT).

• Backward compatible: legacy plaintext secrets are read transparently and upgraded to encrypted (v2:) on the next save or admin page view.
• Still displayed decrypted on the settings page for GitHub setup.

Verified: legacy plaintext verifies; lazy migration to v2: works and keeps verifying; fresh secret stored encrypted (raw DB value is v2:…, no plaintext); live signed webhook returns 200.

Testing

• php -l clean across the plugin; CI green.
• ~30 code-level assertions + live HTTP webhook tests, all passing.

Notes

• No release wp-puller.zip rebuild (handled separately, per CONTRIBUTING).
• New code tagged @since 1.0.8.