v1.8.2 - WP.org review fixes: revoke auth, attribution, enqueue

Addresses the four code issues flagged by the WordPress.org plugin review team. This release does NOT yet address the plugin name / slug / ownership-email items — those are administrative decisions and tracked separately.

Critical security fix

/oauth/revoke now authenticates the client (RFC 7009). The previous implementation had permission_callback => __return_true and looked up tokens purely by hash — no client auth, no token-ownership check. Anyone who knew (or guessed) a token value could revoke it remotely. The endpoint now requires Basic or POST client credentials and matches the token row's client_id to the authenticated client before revoking. RFC 7009 §2.2 200-response semantics preserved on no-match. Per-IP rate limit (20/min) added.

Compliance fixes

• Attribution removed from OAuth consent + error pages. The "powered by HBS IT GmbH" footer is gone (WP.org Guideline 10 forbids user-facing credit without opt-in). Admin attribution is unchanged.
• Inline <script> / <style> extracted to enqueued files. Token + Settings page JS now in assets/js/*.js, registered via wp_enqueue_script + wp_add_inline_script for PHP→JS data. OAuth consent + error pages link assets/css/oauth-consent.css instead of inlining CSS.
• uninstall.php no longer includes core admin files directly. Bot user deletion is now conditional on wp_delete_user already being loaded.

Still pending (decisions, not code)

The review also flagged:

1. Name / slug — "Commander" and "Claude" in the name/slug imply false affiliation. New name + slug needed.
2. Email / identity — submitted from a gmail.com address while plugin claims HBS IT GmbH ownership. Either change WP.org account email to @hbs-it-gmbh.de or add a DNS TXT record wordpressorg-tahersayed-verification at the domain root.