feat: network actor blocking, intel column, post-CRITICAL moment, Upgrade wiring

[cport1]

Plugin side of the P1 Cloud-monetization mechanic. Closes #45. Part of WebDecoy/app#306.

Ships later as 2.4.0 — no version bump in this PR.

Zero-external-calls guarantee, per state

State	Actor feed	Intel column	Post-CRITICAL notice	Enrichment
Unconnected	cron never scheduled → no request	static lock glyph + title, no request	static "Connect" copy, no request	no request
Connected, Free	cron not scheduled (needs features.actor_feed)	one batched, 1h-cached POST /sdk/detections/intel per render for uncached IPs; redacted teaser	intel lookup for the one IP (deferred to admin render)	gated off when synced entitlements say features.enrichment false
Connected, Pro+	hourly GET /sdk/actor-feed?since= while entitled	same batched call, full fields	same, with the upgrade/confirmation copy	allowed when entitled

The feed handler re-checks connected and entitled on every run and unschedules itself otherwise; a 403 upgrade_required unschedules quietly. Queueing the CRITICAL moment writes only local state — the personalising intel lookup happens later, in the connected admin context.

Work items

1. Actor feed + network blocking — includes/class-webdecoy-actor-feed.php. Hourly cron, cursor persisted in an option, pagination via next_since/complete. Inserts through the existing blocked-IPs table as created_by='webdecoy-network', reason "WebDecoy network: known attacker (actor <id>)", rolling +48h expiry. Never inserts an allowlisted IP (exact + CIDR), never touches non-network rows, caps 2000 rows evicting oldest-seen first. Blocked-IPs page shows a Network badge.
2. Actor intel column — new column between MITRE Tactic and Source in detections-page.php, backed by includes/class-webdecoy-actor-intel.php (batched, per-IP 1h cache, redaction-aware, em-dashes on failure).
3. Post-CRITICAL moment — includes/class-webdecoy-critical-moment.php, queued from the CRITICAL detection insert sites, one dismissible admin notice throttled to one per 7 days; connected+known → "first seen N days ago… on Pro it would have been blocked", or the Pro+ confirmation copy; unconnected → static Connect invite.
4. Upgrade wiring + enrichment gate — WebDecoy_Cloud_Connect::wp_upgrade_url() for the billing/wordpress?organization_id=..&plan=wp_pro link; WebDecoy_IP_Enrichment gated behind features.enrichment.

Feed membership / cursor

Membership is server-derived (high-confidence actors with HIGH/CRITICAL detections) — the plugin consumes whatever the endpoint returns. The persisted cursor only ever moves forward (next_since > requested), so a stalled/zero cursor never regresses or loops.

How network rows coexist with user blocks

• Rows this feature owns carry created_by='webdecoy-network'. Insert/refresh/evict operate only on that marker — a human/system/rate-limiter row for the same IP is read once (to detect ownership) and otherwise left completely untouched.
• Before inserting, each IP is run through WebDecoy_Blocker::is_allowlisted() (exact + CIDR), so an allowlisted IP is never network-blocked.
• Refresh sets blocked_at/expires_at for live feed IPs; the existing hourly cleanup_expired cron reaps them 48h after they last appeared. Cap enforcement deletes only network rows, oldest blocked_at first (blocked_at proxies last-seen since it's refreshed each sync).

Throttle design

WebDecoy_Critical_Moment stores the last-queued epoch in the webdecoy_critical_moment_last option; the pure should_queue(last, now, window) gates queuing to at most once per 7 days. The pending notice lives in a 7-day transient (webdecoy_critical_moment) and is consumed on first admin render (one-shot) with is-dismissible.

Tests / checks

• php tests/run.php → 66 passed, 0 failed (added coverage for feed pagination/cap/allowlist-exclusion, intel normalization/redaction, and the notice-throttle/variant logic).
• php -l clean on every touched file. Escaping/sanitize/unslash/nonce + phpcs suppressions follow the existing codebase style (class-webdecoy-blocker.php file-level DB disables); no new superglobal reads.

Notes / left undone

• Among the deception paths, the canary-credential replay is the CRITICAL-severity insert that fires the moment; honeytoken/decoy-served record HIGH and intentionally don't trip the higher-bar CRITICAL moment (the moment also fires from any other insert recorded at CRITICAL, e.g. a client score ≥75).
• enforce_cap uses blocked_at as the last-seen proxy to avoid a schema migration (documented in-code); if precise last_seen eviction is ever required it'd need a new column.
• The feed's per-IP existence check is one query per IP inside the hourly cron (off the request path) — fine at the 2000-row cap; could be bulk-loaded later if needed.
• phpcs/Plugin Check binary isn't installed in this environment; validation was manual against the reviewed patterns.