feat: Sprint 2 — WordPress plugin (auth/api/site-info/admin) + web SiteConnector

- plugin: Wursor_Auth (token hashing, HMAC, scoped tokens), Wursor_API (REST + auth), Wursor_Site_Info (builder/capabilities/preflight), Wursor_Admin
- plugin: test-auth.php (10 auth tests, run in a WP+PHP env)
- web: SiteConnector pairing UI (code + poll + states)
- api: PluginClient signs full REST route (matches WP get_route)
- 92 unit tests green

web/__tests__/SiteConnector.test.tsx

@@ -0,0 +1,31 @@
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { SiteConnector } from '../src/components/SiteConnector.tsx';
+
+describe('SiteConnector', () => {
+  it('shows the pairing code', () => {
+    render(<SiteConnector code="ABCD1234" checkConnected={vi.fn().mockResolvedValue({ connected: false })} />);
+    expect(screen.getByText('ABCD1234')).toBeInTheDocument();
+  });
+
+  it('shows success state when connected', async () => {
+    render(<SiteConnector code="ABCD1234" checkConnected={vi.fn().mockResolvedValue({ connected: true })} />);
+    expect(await screen.findByText('Site connected')).toBeInTheDocument();
+  });
+
+  it('shows error state when the check fails', async () => {
+    render(<SiteConnector code="ABCD1234" checkConnected={vi.fn().mockRejectedValue(new Error('nope'))} />);
+    expect(await screen.findByText('Connection failed')).toBeInTheDocument();
+  });
+
+  it('polls until the site is connected', async () => {
+    const checkConnected = vi
+      .fn()
+      .mockResolvedValueOnce({ connected: false })
+      .mockResolvedValueOnce({ connected: true });
+    render(<SiteConnector code="ABCD1234" checkConnected={checkConnected} pollIntervalMs={5} />);
+
+    expect(await screen.findByText('Site connected')).toBeInTheDocument();
+    expect(checkConnected).toHaveBeenCalledTimes(2);
+  });
+});