security: Fix XSS, insecure token generation, and harden import/export (v0.4.9)

Security audit findings addressed:
- Replace jQuery .html() with safe .text() DOM construction (XSS prevention)
- Use crypto.getRandomValues() instead of Math.random() for token generation
- Add 1MB import size limit to prevent DoS via large JSON payloads
- Remove site_url from metric exports (information disclosure)
- Add import mode allowlist validation

Refactoring:
- Extract shared wp_prometheus_authenticate_request() function (DRY)
- Extract showNotice() helper in admin.js (DRY)
- Extract is_hpos_enabled() helper in Collector (DRY)

Performance:
- Optimize WooCommerce product counting with paginate COUNT query

Housekeeping:
- Add missing options to Installer::uninstall() cleanup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.9] - 2026-02-26
+
+### Security
+
+- Fixed XSS vulnerability: replaced all jQuery `.html()` injections with safe `.text()` DOM construction in admin.js
+- Fixed insecure token generation: replaced `Math.random()` with `crypto.getRandomValues()` (Web Crypto API)
+- Fixed XSS via string interpolation in `updateValueRows()`: replaced HTML string building with jQuery DOM construction
+- Added 1 MB import size limit to prevent DoS via large JSON payloads in CustomMetricBuilder
+- Removed `site_url` from metric export data to prevent information disclosure
+- Added import mode validation (allowlist check) in CustomMetricBuilder
+
+### Changed
+
+- Extracted shared authentication logic (`wp_prometheus_authenticate_request()`) to eliminate code duplication between MetricsEndpoint and isolated mode handler
+- Extracted `showNotice()` helper in admin.js to DRY up 10+ duplicated AJAX response handling patterns
+- Extracted `is_hpos_enabled()` helper method in Collector to DRY up WooCommerce HPOS checks
+- Optimized WooCommerce product type counting: uses `paginate: true` COUNT query instead of loading all product IDs into memory
+- Added missing options to `Installer::uninstall()` cleanup (isolated_mode, storage adapter, Redis/APCu config)
+
 ## [0.4.8] - 2026-02-07
 
 ### Fixed