Release 1.0.2

[bornmw]

Version 1.0.1 → 1.0.2 plus the performance changes from #4.

Why this PR contains more than a version bump: #4 was merged while its base was still refactor/architecture, so its merge commit (cf6e37b — the perf work incl. the e2e flake fix 58046a5) landed on that branch, not on main. This branch is cut from that tip and adds the release commit on top, so merging it brings #4's changes and the 1.0.2 bump into main in one step.

Changes

1. Version bump 1.0.1 → 1.0.2
   • cardea.php (header + CARDEA_VERSION define — the PHPUnit bootstrap parses this, so no test hard-codes the version)
   • package.json + package-lock.json (both root version fields, same convention as the 1.0.1 release)
   • readme.txt Stable tag
2. Changelog = 1.0.2 = covering the merged work (REST PoW parity, unified failure messages, difficulty-at-verify, capped self-pruning cardea_used replay store, synchronous in-worker SHA-256 miner, WP 7.1 set_option() → update_option(), Cardea_Comment_Gate, docs).
3. Upgrade Notice = 1.0.2 = entry.
4. Historical accuracy: the 1.0.0 changelog entry's replay-store line is restored to "via WordPress transients" (the capped-store wording belonged to 1.0.2 and no longer describes 1.0.0).

Content of #4 carried by this branch

• assets/js/pow-worker.js — synchronous FIPS 180-4 SHA-256 miner (KATs + node:crypto cross-checks in jest), unbounded counter, no crypto.subtle (works on plain HTTP)
• includes/class-cardea-core.php — cardea_used capped (1024) self-pruning replay store via update_option() (WP 7.1 removed set_option() — verified on a live WP 7.1 Playground)
• uninstall.php — delete_option('cardea_used') + legacy transient sweep
• includes/class-cardea-admin.php — difficulty solve-time guidance
• tests/js/pow-worker.test.js — real-worker suite (16 tests)
• tests/e2e/pow-comment.spec.js:153 — CI flake fix (settle the post-submission redirect before re-navigating)
• README.md / readme.txt — accurate replay-store/HTTP docs

Test evidence

Full suite green on this branch (Docker, make test + make lint):

• Jest 16/16
• PHPUnit OK (33 tests, 59 assertions)
• Playwright 20/20 (incl. the previously flaky replay test)
• PHPCS clean

Post-merge release steps: make package (fresh dist/cardea.zip) → make sync-svn + tags/1.0.2 → svn commit -m "1.0.2 - REST PoW parity, bounded replay store, sync JS miner, WP 7.1 set_option() compatibility".