feat: Add dashboard extension hook for third-party plugins (v0.4.6)

Add wp_prometheus_register_dashboards action hook allowing third-party
plugins to register their own Grafana dashboard templates.

- DashboardProvider: registration system with file/JSON support
- Security: path traversal protection, JSON validation
- Admin UI: "Extension" badge and plugin attribution
- Isolated mode support for dashboard registration hook

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -23,6 +23,7 @@ This plugin provides a Prometheus `/metrics` endpoint and an extensible way to a
 - Grafana dashboard templates for easy visualization
 - Dedicated plugin settings under 'Settings/Metrics' menu
 - Extensible by other plugins using `wp_prometheus_collect_metrics` action hook
+- Dashboard extension hook `wp_prometheus_register_dashboards` for third-party Grafana dashboards
 - License management integration
 
 ### Key Fact: 100% AI-Generated
@@ -33,7 +34,7 @@ This project is proudly **"vibe-coded"** using Claude.AI - the entire codebase w
 
 **Note for AI Assistants:** Clean this section after the specific features are done or new releases are made. Effective changes are tracked in `CHANGELOG.md`. Do not add completed versions here - document them in the Session History section at the end of this file.
 
-*No planned features at this time.*
+*No pending roadmap items.*
 
 ## Technical Stack
 
@@ -291,6 +292,32 @@ add_action( 'wp_prometheus_collect_metrics', function( $collector ) {
 
 ## Session History
 
+### 2026-02-03 - Dashboard Extension Hook (v0.4.6)
+
+- Added `wp_prometheus_register_dashboards` action hook for third-party plugins
+- Third-party plugins can now register their own Grafana dashboard templates
+- Implementation in `DashboardProvider.php`:
+  - `register_dashboard(slug, args)` method for registrations
+  - Supports file-based dashboards (absolute path to JSON) or inline JSON content
+  - Security: Path traversal protection (files must be under `WP_CONTENT_DIR`)
+  - `fire_registration_hook()` with output buffering and exception handling
+  - Respects isolated mode setting (skips third-party hooks when enabled)
+  - `is_third_party()` and `get_plugin_name()` helper methods
+- Updated admin UI in Settings.php:
+  - "Extension" badge displayed on third-party dashboard cards
+  - Plugin attribution shown below third-party dashboards
+  - Visual distinction with blue border for third-party cards
+- **Key Learning**: Extension hook design pattern
+  - Fire hook lazily on first `get_available()` call, not in constructor
+  - Use `$hook_fired` flag to prevent double-firing
+  - Wrap hook execution in try-catch to isolate failures
+  - Validate registrations thoroughly before accepting them
+- **Key Learning**: Security for file-based registrations
+  - Require absolute paths (`path_is_absolute()`)
+  - Validate files exist and are readable
+  - Use `realpath()` to resolve symlinks and prevent traversal
+  - Restrict to `WP_CONTENT_DIR` (not just plugin directories)
+
 ### 2026-02-02 - Settings Persistence Fix (v0.4.5)
 
 - Fixed critical bug where settings would get cleared when saving from different Metrics sub-tabs