security: REST PoW parity, unified failure message, accurate auth docs and tests

[bornmw]

Fixes the security findings from the review in #1 (S1, S2, S3, S4, S6).

Changes

S2 — REST API parity (includes/class-cardea-core.php): anonymous REST comment submissions were skipping the PoW gate. rest_pre_insert_comment now enforces the identical pipeline (exempt comment types, nonce, challenge verification, replay check) as the comment form, with shared param extraction/sanitization (get_sanitized_rest_param).

S3 — difficulty filter honored at verify time: cardea_difficulty is now resolved through the filter in the verification path, so runtime overrides apply consistently.

S4 — unified failure message: all verification failures surface the same generic message (die_on_verification_failure()); per-cause codes are no longer leaked to the client.

S1 + S6 — accurate documentation and verified tests: readme "Smart Pathway" and FAQ now state the actually-verified behavior for REST and XML-RPC. New/updated tests assert the real behavior:

• REST: anonymous POSTs to /wp/v2/comments are rejected by WordPress core with 401 rest_comment_login_required before Cardea's filter runs (verified in e2e, with and without PoW fields) — Cardea's REST gate is defense-in-depth and is exercised directly in PHPUnit.
• XML-RPC: unknown wp.* comment methods are rejected by core; pingbacks trackbacks bypass PoW by design. Updated spec asserts the rejection/fault set (Playground's WASM transport is nondeterministic for xmlrpc.php text/xml POSTs: it can return XML-RPC server accepts POST requests only. or a fault body).

Pushback (per #1)

• S1 (XML-RPC "botnet block") — not implemented. WordPress core exposes no anonymous XML-RPC comment-creation method (verified: wp.newComment is rejected for anonymous callers), so there is nothing to block. Implementing a blanket XML-RPC block would instead break the intentional pingback bypass. Delivered: honest docs + a test that pins both behaviors.
• S5/S7 (WebCrypto/tls-only mining, 100M counter wrap) touch the same worker file as the performance work — fixed in the performance PR.

Test evidence

Full suite green (Docker, make test + make lint):

• Jest 12/12
• PHPUnit OK (33 tests, 58 assertions) — incl. new REST-parity + generic-message tests
• Playwright 20/20 (both WP 7.0 and latest verified before this PR; suite pinned to latest here)
• PHPCS clean