[mehul0810]

Summary

• Restrict the authenticated settings save endpoint to declared settings fields and reject malformed JSON without reflecting request data.
• Preserve exact stored resource-hint and cache-bypass lists on unrelated saves, including legacy lists exceeding the current 100-item submission bound; changed or new oversized lists fail atomically.
• Display a non-reflective, actionable limit error for rejected oversized list saves and keep it visible until the next save attempt; the textarea retains submitted input.
• Preserve masked Cloudflare secrets, accept valid numeric select values, and reject invalid select values without mutation.
• Declare the cache-select defaults from their established runtime defaults, so a fresh full-form save retains Cache TTL 3600, stale-revalidate 21600, and slow-request threshold 1200.
• Add regression coverage for unknown and nested data, malformed JSON, list bounds, valid/masked saves, invalid selects, full React payloads, and fresh settings defaults. Browser smoke covers default reload persistence and a 300-line rejected bypass-list error.

Fixes #202

Validation

• composer test: 106 tests, 282 assertions; existing PHP 8.5 reflection deprecation notices.
• composer phpstan
• composer lint
• Changed-PHP-file PHPCS: src/Admin/Settings/Menu.php and tests/unit-tests/tests-settings-menu.php
• git diff --check

The repository-wide composer check-cs command remains red on existing style errors outside this PR. Local JavaScript lint/build/Playwright could not run because the required npm dependency install could not resolve raw.githubusercontent.com; CI remains the browser/package proof.

[github-actions]

WordPress Playground Preview

The changes in this pull request can previewed and tested using a WordPress Playground instance.