Add/build tooling

[troychaplin]

What?

Adds a first pass at build tooling for the plugin: linting, static analysis, continuous integration, a pre-commit hook, and contributor documentation — plus the code fixes those tools surfaced.

Why?

The plugin had no automated quality checks. Coding standards, static analysis and CI were all missing, so nothing enforced consistency and nothing verified a branch before review. This establishes the basics so future work has a baseline to build on.

Standing the tooling up also surfaced a set of real defects in the existing code that no one had a way to catch. Those are fixed here rather than deferred, since several of them are one-line changes and leaving them would mean merging a red build.

How?

Tooling added

• ESLint, Stylelint, PHP_CodeSniffer (WordPress Coding Standards) and PHPStan at level 8, all reachable through npm run lint and npm run format.
• GitHub Actions CI: PHPCS and PHPStan across PHP 8.1–8.4, plus JS/CSS linting and a production build.
• A husky pre-commit hook running lint-staged on staged files, followed by a project-wide PHPStan (it can't be scoped to staged files, as it needs whole-codebase context to resolve types).
• .nvmrc pinning Node, .editorconfig for shared editor settings, and wp-env scripts (env:start, env:stop, env:clean).
• CONTRIBUTING.md, a pull request template, and CHANGELOG.md.

Fixes surfaced by the tooling

• The Media Library view-preference AJAX handler passed $_POST['value'] through wp_unslash() without sanitizing. Every branch already validated against an allowlist or cast to int before storing, so nothing was exploitable — this closes the gap ahead of that point.
• uninstall.php assigned to $plugin, which collides with a WordPress global.
• The settings page took a Registry it never read (the React app fetches over REST instead).
• An invalid design-system token in the validation settings stylesheet, several unused variables and imports, and CSS selector specificity ordering in the Media Library view options.

Known follow-ups, deliberately not in this PR

• Heading_Order and Block_Validation_Framework live under Modules/Experiments/ and are documented as Experiments, but both return Bucket::FEATURE / Track::PRACTICAL. All six modules currently report Feature/Practical, so the Experiment and Core-track badges never render in the settings UI. Left for a separate fix, since it changes behaviour rather than tooling.
• Documentation links point at github.com/WordPress/accessibility-lab to match the plugin header's Plugin URI. Those will 404 until the repository moves to the WordPress organisation.
• No automated test suite yet.

Testing Instructions

1. Check out the branch and install from the lock files:

   nvm use
   npm ci
   composer install

2. Confirm all four linters pass:

   npm run lint

   Expect no output from ESLint or Stylelint, 12 / 12 (100%) from PHPCS, and [OK] No errors from PHPStan.

3. Confirm the build succeeds and produces all five bundles:

   npm run build
   ls build/

4. Confirm the pre-commit hook blocks a bad commit — introduce a deliberate lint error in any file under src/, stage it, and attempt to commit. The commit should abort. Revert afterwards.

5. Confirm CI is green on this PR. The JS job reaching the "Build" step is the meaningful signal, since it previously failed at "Install dependencies".

6. Smoke-test the plugin itself, since this PR reformats source files. No behavioural or visual change is intended:

   • Settings → Accessibility Lab — module cards render, toggles save, snackbar confirmations appear.
   • Media Library (both upload.php and the modal) — the view-options button opens its popover; density, items-per-page and filename toggles apply and persist across reloads.
   • Block editor — validation sidebar lists issues, error-level failures still lock publishing.

Changelog Entry

Added - Build tooling: ESLint, Stylelint, PHPCS, PHPStan, GitHub Actions CI, a pre-commit hook, and contributor documentation.

Full entries for this PR are in CHANGELOG.md under [Unreleased], split across Added, Changed and Fixed.