fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Admin/AccessTab.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Admin;
 
 use LIT\MCP\Access;
 
+defined('ABSPATH') || exit;
+
 /**
  * Tab "Zugriff": roles allowed to use LIT MCP and the active OAuth connections
  * with revocation (spec §8.4).

src/Admin/AdminNotices.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 /**
  * Admin notices for administrators (Etappe-0 follow-up d). Uses only cached check
  * results so no HTTP request runs on ordinary admin page loads.

src/Admin/AdminPostAction.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 /**
  * The frame of an admin-post.php handler of the settings page: only administrators
  * (manage_options, else 403), and after the action a redirect back to the tab with a notice.

src/Admin/AdminTab.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 /**
  * One tab of the settings page "Einstellungen → LIT MCP".
  */

src/Admin/ConnectionRepository.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Admin;
 
 use WPMedia\MCP\OAuth\Auth\TokenEndpoint;
 
+defined('ABSPATH') || exit;
+
 /**
  * OAuth connections created by mcp-oauth (v1.1.2, TokenEndpoint): for every grant it
  * creates one application password (name = client name, app_id = the CIMD client_id,

src/Admin/ConnectionStatus.php

@@ -9,6 +9,8 @@ use WP\MCP\Core\McpAdapter;
 use WPMedia\MCP\OAuth\Auth\Discovery\HealthCheck;
 use WPMedia\MCP\OAuth\Context as OAuthContext;
 
+defined('ABSPATH') || exit;
+
 /**
  * Connection checks for the settings page, admin notices and Site Health.
  * Not final so notices and Site Health can be tested with a mock.

src/Admin/ConnectionTab.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 final class ConnectionTab implements AdminTab
 {
     public function __construct(private ConnectionStatus $status)

src/Admin/ConnectionUsage.php

@@ -10,6 +10,8 @@ use WP_REST_Request;
 use WPMedia\MCP\OAuth\Auth\JWT;
 use WPMedia\MCP\OAuth\Auth\SecretManager;
 
+defined('ABSPATH') || exit;
+
 /**
  * Records when an OAuth connection was last used, for "Zuletzt genutzt" in the tab "Zugriff".
  *

src/Admin/LimitsTab.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Admin;
 
 use LIT\MCP\Limits;
 
+defined('ABSPATH') || exit;
+
 /**
  * Tab "Limits": upload/download size and log retention (spec §8.4). The snapshot count is
  * kept as a hidden field until the design system feature that uses it exists.

src/Admin/LogListTable.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Admin;
 use LIT\MCP\ChangeLog\ChangeLog;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 // phpcs:disable PSR1.Methods.CamelCapsMethodName.NotCamelCaps -- method names are defined by WP_List_Table.
 
 /**

src/Admin/LogObjects.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Admin;
 use WP_Post;
 use WP_Term;
 
+defined('ABSPATH') || exit;
+
 /**
  * Human names for the objects in the change log ("Seite: Kontakt" instead of "page 834"),
  * linked to their edit screen where one exists and the current user may use it. prime()

src/Admin/LogTab.php

@@ -8,6 +8,8 @@ use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\Integrations\IntegrationRegistry;
 use LIT\MCP\Limits;
 
+defined('ABSPATH') || exit;
+
 /**
  * Tab "Protokoll": filterable list of change log entries, links to revisions, and
  * "Protokoll leeren" (spec §8.3). Page size and visible columns via WordPress'

src/Admin/SettingsPage.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 /**
  * Settings page "Einstellungen → LIT MCP" with tabs (spec §8.4). Settings API, no JS framework.
  */

src/Admin/SiteHealth.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Admin;
 
+defined('ABSPATH') || exit;
+
 /**
  * Site Health test for our MCP endpoint (401 + WWW-Authenticate without a token).
  * The discovery documents are covered by mcp-oauth's own Site Health test.

src/Admin/ToolsTab.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\ExposurePolicy;
 use LIT\MCP\Integrations\IntegrationRegistry;
 
+defined('ABSPATH') || exit;
+
 /**
  * Tab "Tools": direct/indirect/disabled exposure per ability (spec §8.4), grouped by the
  * integration the ability comes from. Each group has its own mode (inherited by its tools)