feat: grace logins, plugin slot fix, explain modal alignment, save JS…

… bug fix

- Fix: active plugin was cloudscale-code-block (v1.8.86) while all deploys
  went to inactive cloudscale-devtools slot — swapped to correct active slot
- Fix: undefined `slug` variable in hide login save success handler caused
  ReferenceError after every successful save, showing false failure alert
- Fix: Explain modal badge alignment — badge now always centered at top of
  each card, removing flex-wrap inconsistency on narrow mobile screens
- Feat: Grace logins UI — number input in 2FA Settings panel, AJAX save
  handler, and JS payload; allows N logins before 2FA is enforced per user
- Tests: session-persistence.spec.js — 4 Playwright tests confirm 30-day
  persistent cookie (expires > 0) vs default session cookie (expires = -1)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: CS Monitor — infrastructure diagnostics, PDF export, version ch…

…ecks

- Disk space, OPcache, PHP limits, uploads writable checks with Explain steps
- System load average + CPU count (xmlrpc brute force CPU correlation)
- Maintenance mode loop, URL mismatch, rewrite rules, wp-config perms, debug.log checks
- WordPress core + MySQL/MariaDB EOL version detection
- PDF export: Summary + Issues with full remediation steps, timeline, site health
- Issues tab Copy All button (plain text with Explain content)
- PHP errors shown inline on Summary tab
- ms precision fixed to 1dp throughout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: CS Monitor Issues — Explain button with step-by-step remediation

Each issue row now shows an Explain button (when a fix is available).
Clicking it expands an inline fix panel without navigating away from the
Issues tab. Clicking again (or the Close label) collapses it.

Fix content covers all current issue types:
  Security: admin username, db prefix, XML-RPC, readme/license exposure,
            PHP EOL, WP_DEBUG_DISPLAY, DISALLOW_FILE_EDIT/MODS,
            failed logins/brute force, author enumeration, plugin updates, HTTPS
  Performance: autoloaded options, WP-Cron backlog, slow queries, N+1 patterns,
               object cache hit rate, render-blocking scripts, asset bloat

Each fix panel includes: why it matters, numbered steps with inline code
snippets, and an advisory note where relevant. Click does not propagate to
the row's tab-switch handler.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add Snake and Pac-Man games to 404 page (v1.8.77)

- Snake: tick-based movement, wall/self collision, speed ramp every 5 apples
- Pac-Man: 31×14 maze, 3 ghosts with chase AI, power pellets, 3 lives
- Shared 4-directional d-pad for touch (snake/pacman)
- Updated REST regex and score caps for both new games
- Version bump to 1.8.77

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v1.8.6 — Copy to clipboard (all tabs), Escape closes Explain, entity …

…fixes, help panel improvements

- Add Copy button (electric pink) to panel header — copies active tab as plain text
- Summary copy captures everything: env, DB/HTTP/log/cache/asset cards, plugin leaderboard, slowest queries, N+1 patterns, slowest HTTP, dupe queries, slowest hooks
- Escape key closes help panel or collapses open EXPLAIN/detail rows
- Fix build.sh sed dot-escaping bug that was corrupting HTML entities on version bump
- Restore corrupted 🔴 and 📈 entities in Issues/DB titles
- Add overscroll-behavior:contain to help panel (scroll bleed fix)
- Add Template and Transients cards to help panel
- Electric pink accent on Copy and ? buttons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v1.7.45 — Remove debug overlay, restore filemtime cache busting

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v1.7.38 — Fix help popover overflowing screen on mobile

Use position:fixed with max-height + overflow-y:auto so the popover
stays within the viewport on narrow/short screens.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v1.7.37 — CS Monitor: Assets tab, Hooks tab, object cache stats

- Assets tab: all enqueued JS/CSS with plugin attribution, type filter, search
- Hooks tab: top 50 hooks by cumulative time, sortable, searchable
- Summary: object cache hit-rate card, slowest hooks bar chart, assets card
- PHP: perf_hook_tracker(), perf_build_assets_data(), perf_build_cache_data(), perf_build_hooks_data()
- Fixes str_contains → strpos for PHP 7.4 compatibility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add CS Monitor — DevTools-style performance panel (v1.7.35)

Full-featured developer panel docked at the bottom of every admin and
frontend page (manage_options only). Covers:

- DB Queries: timing, plugin attribution, N+1 detection, duplicate
  detection, call-stack trace, EXPLAIN on demand, multi-column sort
- HTTP/REST: outbound call timing, status, plugin attribution
- Logs: reads wp-content/debug.log + in-request PHP errors, filterable
  by level/source; debug toggle stored in DB via ini_set (no
  wp-config.php editing)
- Summary: plugin leaderboard, top queries, N+1 list, dupe groups
- Header: tall pill toggle button, ? help popover, JSON export
- Mobile: horizontal scroll on narrow viewports, query column shown

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Update README with full documentation