Phase 3 v1: autocheck framework + six step automations

Infrastructure:
- WPH_Step::autocheck($session_state) returns an array of findings
  shaped {id, level: ok/warn/bad/info, label, value, detail}.
- WPH_Session stores results keyed by step id (persisted in the option-
  backed session).
- WPH_Step::has_autocheck() reflection check so the UI only renders the
  panel for steps that implement automation.
- 'Run checks' / 'Refresh' button per step, admin-post handler runs
  autocheck() and stashes the result on the session.
- Findings rendered as a coloured table on the step card; included
  verbatim in the Markdown report with status icons.

Step automations implemented:
- Step 1 (Backup): detection of 11 known backup plugins by slug;
  active/inactive state; UpdraftPlus last-backup timestamp.
- Step 2 (Environment): PHP version + EOL, WP version vs latest, disk
  usage, wp-config flags, file perms on wp-config/wp-content/uploads,
  error-log sizes.
- Step 4 (Plugins): WP.org API enrichment with 24h transient cache —
  last_updated, active_installs, abandonment flag, removed-from-repo
  flag, update-available count. Summary line at the top.
- Step 8 (Security): SSL cert expiry via stream_socket_client +
  openssl_x509_parse, administrator audit, xmlrpc reachability, login
  URL hardening detection.
- Step 9 (Database): spam comments, post revisions, autoload size (WP
  6.6+ value handling), top 3 largest tables.
- Step 11 (Small fixes): deactivated-but-installed plugin list,
  homepage alt-text scan.

Smoke-tested on testsite — all six steps return findings with
correctly-classified levels. Report regenerated with automated findings
section.

includes/steps/40-plugins.php

@@ -22,4 +22,112 @@ return new class extends WPH_Step {
             'Plugins showing "Update unavailable" or removed from the WordPress repository — flag immediately, these can indicate abandoned or compromised plugins',
         ];
     }
+
+    public function autocheck(array $session_state): array {
+        if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
+        $plugins = get_plugins();
+        $f = [];
+        $abandoned = 0;
+        $removed = 0;
+        $update_avail = 0;
+
+        // Refresh update transient (no-op if recent)
+        if (function_exists('wp_update_plugins')) wp_update_plugins();
+        $updates = get_site_transient('update_plugins');
+        $update_map = isset($updates->response) && is_array($updates->response) ? $updates->response : [];
+
+        foreach ($plugins as $file => $meta) {
+            $slug = dirname($file);
+            if ($slug === '.' || $slug === '') $slug = basename($file, '.php');
+            $info = $this->wp_org_info($slug);
+            $detail_parts = [];
+            $level = 'ok';
+
+            if ($info === 'not_in_repo') {
+                $level = 'warn';
+                $detail_parts[] = 'Not in WP.org repo (could be premium, custom, or removed)';
+                $removed++;
+            } elseif ($info === 'removed') {
+                $level = 'bad';
+                $detail_parts[] = '⚠ Removed from WP.org repo — possible abandonment or compromise';
+                $removed++;
+            } elseif (is_array($info)) {
+                if (!empty($info['last_updated'])) {
+                    $age_days = floor((time() - strtotime($info['last_updated'])) / DAY_IN_SECONDS);
+                    $detail_parts[] = 'Last release ' . $age_days . ' day(s) ago (' . $info['last_updated'] . ')';
+                    if ($age_days > 365) {
+                        $level = 'warn';
+                        $abandoned++;
+                        $detail_parts[] = 'no release in >12 months';
+                    }
+                }
+                if (!empty($info['active_installs'])) {
+                    $detail_parts[] = number_format($info['active_installs']) . ' active installs';
+                }
+            }
+
+            if (isset($update_map[$file])) {
+                $level = 'warn';
+                $detail_parts[] = 'Update available → ' . ($update_map[$file]->new_version ?? '?');
+                $update_avail++;
+            }
+
+            $f[] = $this->finding(
+                'plugin_' . sanitize_key($file),
+                $level,
+                $meta['Name'] ?? $file,
+                (string) ($meta['Version'] ?? ''),
+                implode(' · ', $detail_parts)
+            );
+        }
+
+        // Summary at the top
+        array_unshift($f, $this->finding(
+            'summary', 'info',
+            'Summary',
+            count($plugins) . ' plugins',
+            $update_avail . ' with updates · ' . $abandoned . ' not updated in 12 mo · ' . $removed . ' not in WP.org'
+        ));
+
+        return $f;
+    }
+
+    /**
+     * Returns ['name' => ..., 'last_updated' => ..., 'active_installs' => ...]
+     * or 'not_in_repo' / 'removed' on failure. Cached 24h per slug via transient.
+     */
+    private function wp_org_info(string $slug) {
+        $cache_key = 'wph_pi_' . md5($slug);
+        $cached = get_transient($cache_key);
+        if ($cached !== false) return $cached;
+
+        $url = 'https://api.wordpress.org/plugins/info/1.0/' . rawurlencode($slug) . '.json';
+        $resp = wp_remote_get($url, ['timeout' => 4]);
+        if (is_wp_error($resp)) {
+            set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
+            return 'not_in_repo';
+        }
+        $code = wp_remote_retrieve_response_code($resp);
+        $body = wp_remote_retrieve_body($resp);
+        if ($code === 404) {
+            set_transient($cache_key, 'not_in_repo', DAY_IN_SECONDS);
+            return 'not_in_repo';
+        }
+        $data = json_decode((string) $body, true);
+        if (!is_array($data)) {
+            set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
+            return 'not_in_repo';
+        }
+        if (isset($data['error'])) {
+            set_transient($cache_key, 'removed', DAY_IN_SECONDS);
+            return 'removed';
+        }
+        $out = [
+            'name'            => $data['name'] ?? $slug,
+            'last_updated'    => $data['last_updated'] ?? null,
+            'active_installs' => $data['active_installs'] ?? null,
+        ];
+        set_transient($cache_key, $out, DAY_IN_SECONDS);
+        return $out;
+    }
 };