edge.* filter fields for the validator's client class (#481)

[cport1]

Part of WebDecoy/app#481. Pairs with WebDecoy/app (worker emits x-wd-class) and WebDecoy/node#12 (Node SDK reads it).

This is discoverability, not new capability

Matching the edge tag already worked on a stock install. collect_request_headers() forwards the whole $_SERVER['HTTP_*'] set into the rule context, so this has always been a valid expression:

req.header("x-wd-class") == "script"

Nobody knew, because nothing said so. The header was documented as "watch it in your logs" and the Fields line on the settings screen never mentioned it.

Now: edge.class, edge.clearance, edge.present, plus shorthands edge.verified / edge.crawler / edge.script / edge.browser. One spelling instead of one per site owner, and it survives us renaming a header. The raw-header form still works, with a test pinning that so nobody has to migrate.

Absence is not a class

A rule using this decides whether to serve someone less, so:

• edge.class is null when the validator did not classify, making a comparison against it false rather than accidentally true
• a value outside the closed set is dropped — outside it means version skew or something that is not our worker
• edge.present false means "no information", not "human", and the settings screen says so in those words

Derived from the headers already on RuleContext rather than added as a constructor argument, so a released plugin's RuleContext signature does not change under anyone.

The cache caveat is in the UI, not only the docs

The settings screen now states that these fields are safe for blocking, throttling, logging and metering — and that serving different page content on a cacheable URL is not:

Cloudflare's cache key ignores this header outside Enterprise plans, so the first version cached is served to everyone including Googlebot, and on a cache hit your site never runs at all.

A site owner reading the field list is exactly the person about to make that mistake.

Testing

php tests/run.php — 84 passed, 0 failed, including four new cases: the fields resolving, absence yielding false for every one of them, an unrecognised value being dropped, and case/whitespace tolerance.

Not in this PR

No version bump. Releasing is a separate decision and goes through bin/release-all.sh.