Tool Kits 2.7.34 — Collector Form Guard Compatibility (Pre-release)

Tool Kits 2.7.34 — Collector Form Guard Compatibility (Pre-release)

Follow-up patch for the on-demand Collector heartbeat added in 2.7.33.
This is a pre-release; the stable release remains 2.7.30.

• Stop fully authenticated heartbeat POSTs from being classified as public form
  submissions during WordPress init, before REST_REQUEST is defined. This avoids
  consuming the public form POST limit and the resulting HTTP 429 for valid checks.
• Keep public form protection for other endpoints, invalid signatures, expired
  requests and mismatched websites/installations. Keep endpoint replay, concurrency
  and cooldown checks.
• Include the remaining wait time in plugin cooldown responses.

Deploy the matching NexaMonitor update to display HTTP 429 as RATE LIMITED, show
a countdown, honor Retry-After and plugin cooldowns, and prevent duplicate checks
from multiple tabs. The existing Check Ulang SQL columns are reused; no new SQL.

Publishing this plugin does not deploy NexaMonitor or update monitored websites.
HTTPS, matching collector tokens, and the signed license API/key inherited from
2.7.31/2.7.32 remain required. See LICENSE_SECURITY.md.

Validation: 55/55 default plugin regression cases pass on PHP 7.4 and PHP 8.4,
including 40 heartbeat/Form Guard authentication and cooldown checks. 32 targeted
NexaMonitor tests pass with 356 assertions, including Retry-After, countdown,
concurrent requests and recovery to ACTIVE after the wait.