fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/Compose/Composer.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Builds new Divi blocks from node descriptions (spec §5.4): short form, full form ("attrs")
  * or both; sections with rows ("columns": "1_3,2_3") and modules; parent modules with