Security hardening and accessibility improvements (v1.1.0)

Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

includes/class-att-consent.php

@@ -104,7 +104,7 @@ class ATT_Consent {
 			new ATT_Consent_Admin();
 		}
 
-		if ( ! is_admin() || wp_doing_ajax() ) {
+		if ( ! is_admin() ) {
 			require_once ATT_CC_PLUGIN_DIR . 'includes/class-frontend.php';
 			new ATT_Consent_Frontend();
 		}