Bricks Builder MCP v1.13.2

Pre-merge audit fixes (v1.13.2)

Bug #1 — CRITICAL: currentType JS var read cfg.type (undefined) instead
of cfg.currentType, causing any existing non-PHP snippet to be saved as
PHP type if saved without clicking a type tab. Fix: cfg.currentType.

Bug #2: PHP snippets with a leading <?php tag stored it in the code and
in the signature hash. Strip it on save in save_snippet() since the
editor decorator already shows it visually and eval() doesn't need it.

Bug #3: type/location fields in save_snippet() had no allowlist check.
Now validated against TYPES/LOCATIONS constants with safe fallback.

Bug #4: dead hiddenType variable referencing non-existent DOM element
removed from snippet-edit.js.

Security #5: ajax_snip_save used sanitize_url() (WP 5.9+ only alias)
instead of esc_url_raw() — now consistent with save_snippet().

Robustness #6: added explicit return after wp_send_json_error() calls