Clear 74 pre-existing phpstan errors blocking release preflight

[chubes4]

Context

PR #74 cleared all phpcs lint debt (467 → 0 errors). However, the release preflight (homeboy lint) also runs phpstan, which still reports 74 pre-existing errors. Until these are cleared, homeboy release continues to require --skip-checks for the phpstan phase.

These were intentionally left out of #74 because they require type-aware logic changes (not formatting) and that PR was scoped to lint-only/no-behavior-change.

Breakdown by rule

• 18× phpstan.property.nonObject — property access on a possibly-non-object (missing null/WP_Error guards)
• 13× phpstan.function.notFound — calls to functions phpstan can't resolve (likely cross-plugin helpers needing stubs or function_exists guards / proper bootstrap)
• 10× phpstan.argument.templateType
• 7× phpstan.return.type
• 7× phpstan.return.unusedType
• 7× phpstan.function.impossibleType — conditions that always evaluate one way (e.g. is_wp_error() on a type that can't be WP_Error)
• 3× phpstan.argument.type — e.g. WP_User|false passed where WP_User expected
• 2× phpstan.method.nonObject
• 1× each: foreach.nonIterable, booleanNot.alwaysFalse, cast.int, notIdentical.alwaysTrue, function.alreadyNarrowedType, property.notFound, ternary.alwaysTrue

Hotspot files

• 13× inc/routes/shop/products.php
• 5× inc/routes/auth/register.php
• 5× inc/routes/media/upload.php
• 5× inc/routes/newsletter/management.php
• 4× inc/routes/auth/login.php
• 3× each: inc/routes/auth/google.php, inc/routes/auth/me.php, inc/routes/contact/submit.php, inc/routes/shop/product-images.php
• (remaining spread 1–2 per file across auth/shop/analytics/admin/users/blog/docs routes)

Notes / approach

• These are genuine type-safety findings — fixes will touch logic (null guards, WP_Error handling, type narrowing, proper function stubs for cross-plugin helpers).
• phpstan.function.notFound (13×) may be largely resolvable by configuring phpstan stubs / bootstrap for the cross-plugin function surface rather than per-call guards — worth investigating first since it's the second-largest bucket.
• Reproduce: homeboy lint extrachill-api (phpstan findings are the "source":"phpstan" entries).

Done when

• homeboy lint extrachill-api reports 0 phpstan errors
• Combined with style: clear phpcs lint debt (release preflight) #74, homeboy release extrachill-api no longer needs --skip-checks

[chubes4]

Note: preflight.test also fails as infrastructure error — composer test invokes vendor/bin/phpunit but there's no phpunit.xml/tests, so phpunit exits 2 with usage text. Same pattern as extrachill-analytics#114. Until fixed, releases need --skip-checks=lint,test.