Phase 3 v2: all step automations + cross-cutting UI

Step automations (six more):
- Step 3 (Core): current vs latest WP version, db upgrade flag, auto-
  update policy, safe-update sequence reminder.
- Step 5 (Theme): parent/child detection, customisation warning when
  non-default theme without child, theme update available, inactive
  theme list.
- Step 6 (Visual): mShots screenshot URL, key-page HEAD checks (home,
  login, posts page, WC shop/cart/checkout), mixed-content scan.
- Step 7 (Performance): keyless PageSpeed Insights v5 API (mobile +
  desktop, cached 12h, skipped on .local), caching plugin detection,
  heavy-image scan (>500KB).
- Step 10 (Uptime): monitoring plugin detection (ManageWP, MainWP,
  Jetpack, WP Umbrella, UptimeRobot), www/non-www canonical check.
- Step 12 (Wrap-up): cross-step rollup — bad/warn counts, blocked
  steps, top examples for the technician's final glance.

Cross-cutting:
- Sticky step-index sidebar with status dots per step (the linear-
  stepper alternative that keeps the overview).
- 'Stop & escalate' summary card at top listing blocked steps with
  escalation guidance and notes.
- Previous-session snapshot stored on finish; diff banner on the next
  session shows new/resolved/changed counts.
- HTML report builder (printable, inline-styled). Download HTML,
  Download Markdown, Copy, and Email actions on the finish panel.
  Email uses wp_mail with text/html.

Smoke-tested on testsite: all 12 steps return findings (5/9/4 by level
on a fresh local install), admin page renders with all UI markers,
HTML report is 26KB, Markdown report is 13KB, prev-session diff banner
appears on second session.

Deferred:
- hc-5ix.27 self-hosted update channel — needs hosting infra.
- Full PDF report — would need vendoring Dompdf.
- Step 3 safe-mode update wizard — worth its own bead.

includes/steps/60-visual.php

@@ -20,4 +20,70 @@ return new class extends WPH_Step {
             'Redirects — confirm www/non-www and HTTP/HTTPS are redirecting correctly to the canonical URL',
         ];
     }
+
+    public function autocheck(array $session_state): array {
+        $f = [];
+        $home = home_url('/');
+
+        // mShots screenshot (WordPress.com's public screenshot service, no key needed)
+        $shot = 'https://s.wordpress.com/mshots/v1/' . rawurlencode($home) . '?w=1200';
+        $f[] = $this->finding(
+            'screenshot',
+            'info',
+            'Homepage screenshot',
+            $home,
+            'mShots: ' . $shot . ' — open this URL to view the rendered preview.'
+        );
+
+        // Key pages we should be able to find
+        $pages = [
+            'Home'        => $home,
+            'Login'       => wp_login_url(),
+            'Posts page'  => function_exists('get_post_type_archive_link') ? get_post_type_archive_link('post') : '',
+        ];
+        if (function_exists('get_option')) {
+            $page_for_posts = (int) get_option('page_for_posts');
+            if ($page_for_posts) $pages['Posts page'] = get_permalink($page_for_posts) ?: $pages['Posts page'];
+        }
+        // WooCommerce shop?
+        if (class_exists('WooCommerce') && function_exists('wc_get_page_id')) {
+            $shop_id = (int) wc_get_page_id('shop');
+            if ($shop_id > 0) $pages['WC shop'] = get_permalink($shop_id);
+            $cart_id = (int) wc_get_page_id('cart');
+            if ($cart_id > 0) $pages['WC cart'] = get_permalink($cart_id);
+            $checkout_id = (int) wc_get_page_id('checkout');
+            if ($checkout_id > 0) $pages['WC checkout'] = get_permalink($checkout_id);
+        }
+
+        foreach ($pages as $label => $url) {
+            if (!$url) continue;
+            $resp = wp_remote_head($url, ['timeout' => 5, 'redirection' => 3]);
+            if (is_wp_error($resp)) {
+                $f[] = $this->finding('page_' . sanitize_key($label), 'bad', $label, $url, $resp->get_error_message());
+                continue;
+            }
+            $code = wp_remote_retrieve_response_code($resp);
+            $level = ($code >= 200 && $code < 400) ? 'ok' : 'bad';
+            $f[] = $this->finding('page_' . sanitize_key($label), $level, $label, 'HTTP ' . $code, $url);
+        }
+
+        // Mixed content quick check on homepage
+        if (parse_url($home, PHP_URL_SCHEME) === 'https') {
+            $body_resp = wp_remote_get($home, ['timeout' => 6]);
+            if (!is_wp_error($body_resp)) {
+                $body = (string) wp_remote_retrieve_body($body_resp);
+                preg_match_all('/(?:src|href)\s*=\s*["\']http:\/\/[^"\']+["\']/i', $body, $m);
+                $http_count = isset($m[0]) ? count($m[0]) : 0;
+                $f[] = $this->finding(
+                    'mixed_content',
+                    $http_count > 0 ? 'warn' : 'ok',
+                    'Mixed content',
+                    $http_count . ' http:// reference(s) on homepage',
+                    $http_count ? 'Browsers will block or warn — replace with https:// or protocol-relative URLs.' : ''
+                );
+            }
+        }
+
+        return $f;
+    }
 };