Add FedCM (Federated Credential Management) support (#299)

* Add FedCM (Federated Credential Management) support

Implements FedCM for IndieAuth as specified at indieweb.org/FedCM_for_IndieAuth

New endpoints:
- GET /indieauth/1.0/fedcm/config.json - IdP configuration
- GET /indieauth/1.0/fedcm/accounts - User accounts list
- GET /indieauth/1.0/fedcm/client_metadata - Client metadata
- POST /indieauth/1.0/fedcm/assertion - Authorization code issuance

Features:
- Well-known web-identity endpoint (/.well-known/web-identity)
- Login Status API integration (Set-Login headers)
- Automatic IdP registration via IdentityProvider.register()
- PKCE support for all FedCM flows
- CORS headers for cross-origin requests
- Sec-Fetch-Dest validation for security

* Address PR review feedback

- Use absolute URLs in config endpoint instead of relative paths
- Add validation/sanitization for account_id parameter
- Sanitize nonce parameter with sanitize_text_field()
- Validate code_challenge_method is S256
- Sanitize code_challenge and code_challenge_method from params
- Use filemtime() for dynamic script versioning
- Add JSON decode error checking for params

* Add FedCM endpoint tests

Tests cover:
- Config endpoint returns valid configuration with absolute URLs
- Accounts endpoint requires Sec-Fetch-Dest header
- Accounts endpoint requires authentication
- Accounts endpoint returns user data when authenticated
- Client metadata endpoint returns data for known clients
- Assertion endpoint requires Sec-Fetch-Dest header
- Assertion endpoint requires matching Origin header
- Assertion endpoint requires authentication
- Assertion endpoint requires PKCE parameters
- Assertion endpoint requires S256 code_challenge_method
- Assertion endpoint rejects invalid JSON in params
- Assertion endpoint issues valid authorization codes
- Assertion endpoint verifies account_id matches current user
- Assertion endpoint stores nonce in authorization code
- FedCM-issued codes are marked with fedcm flag

* Address additional PR review feedback

- Change generic 'Invalid request' to 'Missing or invalid Sec-Fetch-Dest header'
- Add scheme validation to Origin check (prevents http/https mismatch)
- Remove redundant Content-Type headers (WP_REST_Server sets automatically)
- Add scope flexibility with indieauth_fedcm_scope filter
- Add console.debug logging for registration failures
- Fix activation hook to load class file before checking existence
- Improve params type validation with explicit error for invalid format
- Add test for Origin scheme mismatch

* Address GitHub feedback: OOB redirect_uri, CORS on config, port validation

- Use 'urn:ietf:wg:oauth:2.0:oob' for redirect_uri since FedCM doesn't redirect
- Add CORS headers to config.json endpoint per FedCM spec requirement
- Add port validation to Origin check (scheme + host + port must all match)
- Add test case for port mismatch in Origin validation

* Make params required in assertion endpoint per reviewer feedback

- Add 'required' => true to params arg to fail early if PKCE params missing
- Add sanitize_callback for nonce in route definition for consistency

* Fix tests and update test configuration

- Fix wp-env mapping for tests to include vendor directory
- Fix package.json test script path
- Fix composer.json script typo and macOS cp compatibility
- Update FedCM tests to include params and handle account_id validation
- Update test-functions.php to handle URL validation in test environment
- Add .phpunit.result.cache to .gitignore

* Unify .distignore and .svnignore, remove obsolete files

* Clean up .distignore to match actual repository files

* Remove gitignored files from .distignore

* Clean up .gitattributes to match repository files

* Sync .gitattributes with .distignore, remove .claude

* Add .claude to .gitignore

Updated .gitignore to exclude the .claude file from version control.

* Add missing @Package file doc comments for PHPCS compliance

* Fix FedCM review issues: early param validation, test location, doc comments

- Add validate_params callback to assertion route for early PKCE validation
  (addresses dshanske's review: fail at route level, not deep in callback)
- Move test file to tests/phpunit/tests/includes/class-test-fedcm-endpoint.php
  to match restructured test directory and phpunit.xml.dist testsuite config
- Add file doc comments to test file for PHPCS compliance
- Remove duplicate @Package tags from class-level doc comments
- Use user_email instead of URL for FedCM account email field

* Fix failing FedCM tests after moving validation to route level

- Fix allow_test_user_identifier filter to only clear account_id errors
  when it's the sole invalid param, preserving params validation errors
- Update test assertions to match OAuth error response format (error key)

Author: pfefferle

.gitignore

@@ -1,4 +1,4 @@
-
+.claude
 node_modules
 vendor
 npm-debug.log