Implement Phase 10: REST API Endpoints (v0.10.0)

- Add complete REST API infrastructure under src/Api/
- ResponseFormatter for standardized responses
- RateLimiter with tiered limits (public 60/min, availability 30/min, booking 10/min, admin 120/min)
- AbstractController base class with common functionality
- BuildingsController: list, get, rooms endpoints
- RoomsController: list, get, availability, calendar, search endpoints
- BookingsController: CRUD + confirm/check-in/check-out status transitions
- GuestsController: list, get, search, booking history (admin only)
- ServicesController: list, get, calculate endpoints
- PricingController: calculate, seasons endpoints
- API settings tab with enable/disable toggles
- Comprehensive API documentation in README

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,67 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-02-03
+
+### Added
+
+- REST API Infrastructure:
+  - New `src/Api/` directory with complete REST API implementation
+  - `ResponseFormatter.php` - Standardized response formatting (success, collection, error responses)
+  - `RateLimiter.php` - Transient-based rate limiting with tiered limits
+  - `Controllers/AbstractController.php` - Base controller with common functionality
+  - `RestApi.php` - Main registration class with namespace `wp-bnb/v1`
+- Buildings API:
+  - `GET /wp-bnb/v1/buildings` - List buildings with pagination and search
+  - `GET /wp-bnb/v1/buildings/{id}` - Get single building with address, contact, details
+  - `GET /wp-bnb/v1/buildings/{id}/rooms` - Get rooms in a building with status filter
+- Rooms API:
+  - `GET /wp-bnb/v1/rooms` - List rooms with filters (building, room_type, amenities, capacity, status)
+  - `GET /wp-bnb/v1/rooms/{id}` - Get room details with gallery, pricing, amenities
+  - `GET /wp-bnb/v1/rooms/{id}/availability` - Check availability with price calculation
+  - `GET /wp-bnb/v1/rooms/{id}/calendar` - Get monthly calendar data
+  - `POST /wp-bnb/v1/availability/search` - Search available rooms by date range and criteria
+- Bookings API:
+  - `POST /wp-bnb/v1/bookings` - Create booking (public, creates pending status)
+  - `GET /wp-bnb/v1/bookings` - List bookings with filters (admin)
+  - `GET /wp-bnb/v1/bookings/{id}` - Get booking details (admin)
+  - `PATCH /wp-bnb/v1/bookings/{id}` - Update booking (admin)
+  - `DELETE /wp-bnb/v1/bookings/{id}` - Cancel booking (admin)
+  - `POST /wp-bnb/v1/bookings/{id}/confirm` - Confirm pending booking (admin)
+  - `POST /wp-bnb/v1/bookings/{id}/check-in` - Check in guest (admin)
+  - `POST /wp-bnb/v1/bookings/{id}/check-out` - Check out guest (admin)
+- Guests API (admin only):
+  - `GET /wp-bnb/v1/guests` - List guests with pagination
+  - `GET /wp-bnb/v1/guests/{id}` - Get guest details (excludes encrypted ID numbers)
+  - `GET /wp-bnb/v1/guests/search` - Search guests by name/email
+  - `GET /wp-bnb/v1/guests/{id}/bookings` - Get guest's booking history
+- Services API:
+  - `GET /wp-bnb/v1/services` - List active services with categories
+  - `GET /wp-bnb/v1/services/{id}` - Get service details with pricing info
+  - `POST /wp-bnb/v1/services/{id}/calculate` - Calculate service price for booking
+- Pricing API:
+  - `POST /wp-bnb/v1/pricing/calculate` - Full price calculation with services
+  - `GET /wp-bnb/v1/pricing/seasons` - Get configured seasons and pricing modifiers
+- API Settings tab in plugin settings:
+  - Enable/disable REST API toggle
+  - Enable/disable rate limiting toggle
+  - Endpoint documentation table
+  - Authentication instructions
+
+### Changed
+
+- Plugin.php updated to initialize REST API on `rest_api_init` hook
+- Settings page now has seven tabs: General, Pricing, License, Updates, Metrics, API
+- README.md updated with comprehensive REST API documentation
+
+### Security
+
+- Rate limiting: public (60/min), availability (30/min), booking (10/min), admin (120/min)
+- Admin endpoints require `edit_posts` capability
+- Supports WordPress Application Passwords for external API access
+- Client identification by user ID (authenticated) or IP address (anonymous)
+- Proxy/Cloudflare IP detection via X-Forwarded-For and CF-Connecting-IP headers
+
 ## [0.9.0] - 2026-02-03
 
 ### Added