feat: Add comprehensive PHPUnit test suite and CI/CD test gating (v0.5.0)

189 tests across 8 test classes covering all core plugin classes:
CustomMetricBuilder, StorageFactory, Authentication, DashboardProvider,
RuntimeCollector, Installer, Collector, and MetricsEndpoint.

Added test job to Gitea release workflow that gates build-release.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -209,7 +209,7 @@ When editing CLAUDE.md or other markdown files, follow these rules to avoid lint
 ```txt
 wp-prometheus/
 ├── .gitea/workflows/
-│   └── release.yml          # CI/CD pipeline
+│   └── release.yml          # CI/CD pipeline (test + build)
 ├── assets/
 │   ├── css/                  # Admin/Frontend styles
 │   ├── dashboards/           # Grafana dashboard templates
@@ -238,10 +238,28 @@ wp-prometheus/
 │   ├── Installer.php         # Activation/Deactivation
 │   ├── Plugin.php            # Main plugin class
 │   └── index.php
+├── tests/
+│   ├── bootstrap.php         # WP constants + function stubs
+│   ├── Helpers/
+│   │   └── GlobalFunctionState.php  # Controllable stub state
+│   └── Unit/
+│       ├── TestCase.php      # Base class with PHPMock
+│       ├── AuthenticationTest.php
+│       ├── InstallerTest.php
+│       ├── Admin/
+│       │   └── DashboardProviderTest.php
+│       ├── Endpoint/
+│       │   └── MetricsEndpointTest.php
+│       └── Metrics/
+│           ├── CollectorTest.php
+│           ├── CustomMetricBuilderTest.php
+│           ├── RuntimeCollectorTest.php
+│           └── StorageFactoryTest.php
 ├── CHANGELOG.md
 ├── CLAUDE.md
 ├── composer.json
 ├── index.php
+├── phpunit.xml               # PHPUnit 10 configuration
 ├── PLAN.md
 ├── README.md
 ├── uninstall.php
@@ -290,6 +308,46 @@ add_action( 'wp_prometheus_collect_metrics', function( $collector ) {
 
 ## Session History
 
+### 2026-02-26 - PHPUnit Test Suite & CI/CD Integration (v0.5.0)
+
+- Created comprehensive PHPUnit test suite with 189 tests and 329 assertions
+- Added `php-mock/php-mock-phpunit:^2.10` to composer.json require-dev
+- Created test infrastructure:
+  - `tests/bootstrap.php`: ~45 WordPress function stubs with `if (!function_exists())` guards
+  - `tests/Helpers/GlobalFunctionState.php`: Static class for controlling stub behavior
+  - `tests/Unit/TestCase.php`: Abstract base class with PHPMock trait
+- 8 test classes covering all core plugin classes:
+  - `CustomMetricBuilderTest` (35 tests) - validation, CRUD, import/export
+  - `StorageFactoryTest` (25 tests) - adapter config, env vars, connection tests
+  - `AuthenticationTest` (13 tests) - Bearer/query auth, header extraction
+  - `DashboardProviderTest` (27 tests) - registration, path traversal security
+  - `RuntimeCollectorTest` (22 tests) - endpoint normalization, histograms
+  - `InstallerTest` (11 tests) - activate, deactivate, uninstall cleanup
+  - `CollectorTest` (10 tests) - registry, register_gauge/counter/histogram, render
+  - `MetricsEndpointTest` (5 tests) - rewrite rules, request routing
+- Added `test` job to `.gitea/workflows/release.yml` that gates `build-release`
+- **Key Learning**: php-mock/php-mock-phpunit for WordPress testing without WP environment
+  - Intercepts unqualified function calls in namespaced code via PHP namespace fallback
+  - `$this->getFunctionMock('Namespace', 'function_name')` creates expectations
+  - Does NOT work for functions called from global namespace (bootstrap stubs) or in PHP 8.4 for some edge cases
+  - Solution for global-scope stubs: Make them controllable via `GlobalFunctionState::$options`
+- **Key Learning**: Testing singletons and static state
+  - Use `ReflectionClass::newInstanceWithoutConstructor()` to bypass private constructors
+  - Reset static `$instance` properties via `ReflectionProperty::setValue(null, null)` in tearDown
+  - Always reset StorageFactory and RuntimeCollector singletons between tests
+- **Key Learning**: CI/CD pipeline structure for test gating
+  - `test` job uses `composer install` (WITH dev deps) to run tests
+  - `build-release` job uses `--no-dev` (unchanged) for production builds
+  - `needs: test` dependency ensures failing tests block releases
+
+### 2026-02-26 - Security Audit & Refactoring (v0.4.9)
+
+- Fixed XSS vulnerabilities in admin.js (jQuery `.html()` → safe DOM construction)
+- Fixed insecure token generation (`Math.random()` → Web Crypto API)
+- Added 1 MB import size limit, import mode validation, removed `site_url` from exports
+- Extracted shared authentication logic and helper methods
+- Optimized WooCommerce product counting with COUNT query
+
 ### 2026-02-07 - Fix Early Textdomain Loading (v0.4.8)
 
 - Fixed `_load_textdomain_just_in_time` warning on admin pages (WordPress 6.7+ compatibility)