- Add SECURE_DEFAULTS.md with comprehensive security checklist covering:
  - PHP configuration best practices
  - Input validation patterns with php-aegis Validator
  - Output sanitization with php-aegis Sanitizer
  - HTTP security headers configuration
  - Authentication, database, file, and crypto guidelines
  - CI/CD and dependency management practices

- Add phpstan.neon with maximum strictness (level 9)
  - Enable all strict type checks
  - Check for implicit mixed types
  - Report maybes in method signatures

- Add .php-cs-fixer.dist.php with PSR-12 and security rules
  - Enforce strict_types declaration
  - Enable strict comparisons
  - Warn on eval() usage
  - Migrate to secure random functions

- Add php-lint.yml CI workflow with comprehensive checks:
  - PHP syntax validation
  - PHP-CS-Fixer code style enforcement
  - PHPStan level 9 static analysis
  - SPDX license header verification
  - strict_types declaration check
  - Security pattern detection (dangerous functions, weak crypto)
  - Composer dependency audit
  - PHP 8.1-8.4 compatibility matrix

- Update .gitignore for PHP tooling cache files