fix: the last four places we still promise things we do not do

[cport1]

Companion to WebDecoy/app#761. Copy only, no behaviour change, no version bump.

The claim that keeps coming back

#476 withdrew blocking from the cross-site actor feed after measuring it against production: 2 of 4,866 addresses ever seen at more than one site, 93% of attacker addresses gone inside an hour, 82% of feed entries already a week stale, none still active. Blocking an abandoned address does not stop the attacker, it stops whoever holds it now.

That fix landed here in 2.3.2. purge_feed_blocks() deletes the rows earlier versions wrote, and both connected variants of the CRITICAL notice were rewritten with a comment above them:

Must not claim Pro would have BLOCKED this. Since 2.3.2 the cross-site feed is advisory and writes nothing to the block list, on any plan.

Four lines below that comment, the unconnected variant went on offering "and to block threats like it automatically" for another three weeks.

A comment asking the next person not to do something is not a guard. There is now a test: it reads every translatable string in the file and fails on one promising to block, prevent or stop anything. Comments in the file discuss blocking at length and are deliberately exempt. Verified by putting the sentence back:

✗ no translatable string in the file offers to block anything
  copy promises "block" — the feed is advisory on every plan and writes
  nothing to the block list (#476): A CRITICAL deception trap was just
  tripped. Connect to WebDecoy Cloud to see whether this attacker is already
  known across the network, and to block threats like it automatically.

The wordpress.org listing

Live on the directory today, so these are the ones a stranger reads.

• "Webhooks & Alerts: automated response chains, email notifications." The API refuses per-detection email (#702). Decoys are public bait and a busy site records thousands of hits a day, so "email me on every detection" is a mailbox nobody reads. Now: automated response chains plus a monthly email report.
• "Push confirmed attackers to Cloudflare or AWS WAF." True, and it happens in the dashboard. Stated without that, in a plugin readme, it reads like something the plugin does. The claim keeps its substance and gains its location.
• "Start Free Trial" → "Create a free account". There is no trial on this channel: a connected site is Free Connected, free, indefinitely. Sending someone to a trial they cannot start is a dead end at the exact moment they decided to sign up.
• The settings upsell said "email alert automation" for the same reason, now the webhook plus the monthly report.

Release

95 tests pass, php -l clean on both touched PHP files.

Nothing here changes behaviour, so no version bump. The readme correction only reaches wordpress.org after an SVN sync, which is a separate deliberate step and not part of this PR.

Refs WebDecoy/app#759, WebDecoy/app#476, WebDecoy/app#702

[cport1]

Added a second commit: the Cloud tab now reads features.alerts and says whether Slack and webhook alerts are on, with a link to where they are configured.

That flag has been served true to paid plans since P0 and read by nothing, here or anywhere. The companion is WebDecoy/app#764, which makes it mean something in the backend and the rule-engine.

The plugin still sends nothing itself, deliberately: the PRD's §9 guardrail is that an entitlement check gates a cloud response and never local behaviour. Everything this plugin does on its own keeps working on every plan, including with no account.

The free-tier line names what stays free rather than only what is missing. "What do I lose by not paying" belongs on the same line as the pitch.