Add bounded admin asset audit

[mehul0810]

Closes #141.

Summary

• adds an opt-in Admin Asset Audit with a dedicated read-only report tab
• samples final WordPress admin script/style queues by stable screen ID
• reports bounded handles, asset type, likely source, confidence, and repeated cross-screen presence
• keeps collection per-site and limited to 30 screens, 100 assets per screen, and seven days
• adds a protected clear action, documentation, responsive UI, unit tests, and hosted browser proof

Safety and privacy

• no script or style is dequeued, deregistered, or modified
• repeated presence is explicitly presented as a review signal, not proof an asset is unnecessary
• no asset URLs, query strings, nonces, request data, or user data are stored
• source attribution is high confidence only for recognizable WordPress core/plugin/theme paths and otherwise falls back to unknown
• disabled mode registers no collection hooks

Validation

• composer test — 133 tests, 415 assertions
• composer lint — 84 PHP files
• scoped PHPCS
• composer phpstan
• npm run test:unit — 34 tests
• npm run lint
• npm run build
• git diff --check

Hosted Playwright proof covers opt-in sampling across representative admin screens, privacy and limitation copy, repeated-presence evidence, desktop/mobile layout, clearing, disablement, and lower-privilege denial.

[github-actions]

WordPress Playground Preview

The changes in this pull request can previewed and tested using a WordPress Playground instance.