ARGUS WordPress Defence 7.23.0

Real changes since 1.0.0, all live-verified before this release:

- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
  coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
  analysis score could disagree with no explanation (e.g. a benign file
  showing CRITICAL next to Score 0); both are now derived consistently
  and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
  for every other installed plugin and theme (Settings, on by default) --
  uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
  click on its own page, with an honest, specific description of exactly
  what's shared (an IP address, a reason code, a confidence score, a
  country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
  protecting the site, and surfaces the few real optional choices in one
  place.
- Dashboard: running version now visible in the header; new "IPs
  Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
  this codebase. Two real compliance issues found and fixed (see above:
  Global Threat Intelligence's default, and the self-update mechanism,
  which is excluded from this build entirely -- WordPress.org prohibits
  a plugin from using any update channel other than its own, even an
  inert one). This release is still self-distributed, not a WordPress.org
  submission -- that remains a future step.

Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

includes/class-argus-settings.php

@@ -24,6 +24,7 @@ class Argus_Settings {
 		'upload_scan_enabled'        => true,
 		'vuln_intel_enabled'         => true,
 		'geoip_rir_enabled'          => true,
+		'auto_update_all_enabled'   => true,
 		'static_cache_enabled'       => false,
 		'static_cache_ttl_secs'      => 3600,
 		'cache_stale_grace_secs'     => 600,
@@ -45,7 +46,15 @@ class Argus_Settings {
 		'exceptions'                 => array(), 
 		'cloud_connected'            => false,
 
-		'anis_enabled'               => true,
+		// Off by default -- ANIS Cloud shares blocked visitors' IP addresses
+		// with an external service, so it requires the site owner's explicit
+		// opt-in (Settings checkbox or the first-run admin notice) rather than
+		// connecting silently on activation. WordPress.org's guidelines
+		// require clear consent before any such external connection; this is
+		// still zero-configuration in the sense that mattered before -- there
+		// is no server address, license key, or tier field to fill in, only
+		// a single "enable" action.
+		'anis_enabled'               => false,
 		'anis_base_url'              => 'https://anis.weboria.eu',
 		'anis_license_key'           => '',