PHPSTAN: validate against version 3,4 & 5

[masteradhoc]

What?

Raise PHPStan baseline in this branch from level 4 to level 5 and fix all resulting level 5 findings so the full repository passes static analysis and lint checks.

Why?

The plugin already passed at level 2, but level 3,4 & 5 surfaced stricter type-safety issues (mostly scalar typing around escaping and auth-code handling). Fixing these now improves type correctness, keeps CI healthier as rules tighten, and reduces future refactor risk.

How?

This PR updates the PHPStan level and applies targeted, behavior-preserving type fixes

Use of AI Tools

AI assistance: Yes
Tool(s): GitHub Copilot
Model(s): GPT-5.3-Codex
Used for: Static analysis triage, proposing and applying type-safety fixes, and drafting PR documentation.
Human review: All generated changes were reviewed and validated through local lint/static-analysis runs.

Testing Instructions

1. Install dependencies:
   npm install

2. Run full lint suite:
   npm run lint

3. Run PHPStan directly with repo config:
   vendor/bin/phpstan analyse -c phpstan.dist.neon --memory-limit=1G

4. Optional explicit level check:
   vendor/bin/phpstan analyse -c phpstan.dist.neon --level=5 --memory-limit=1G

Expected result:

• All commands complete successfully.
• PHPStan reports OK with no errors.

Screenshots or screencast

Not applicable (no UI behavior change).

Before	After
PHPStan level 5 reported 14 errors across core/providers/settings	PHPStan level 5 reports no errors

Changelog Entry

Development Update - Raise PHPStan to level 5 and resolve level 5 type-safety findings across core and providers.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[jeffpaul]

Checks pass, which is great, but if we're getting things updated on PHPStan should we then ensure there's a check to ensure future updates adhere to that as well (maybe that's already part of the "Test / Lint PHP & PHP Compatibility checks." check though?

Also, what's the "Aufgabenliste aktualisiert" bit in the PR description?

[masteradhoc]

Thanks @jeffpaul

Checks pass, which is great, but if we're getting things updated on PHPStan should we then ensure there's a check to ensure future updates adhere to that as well (maybe that's already part of the "Test / Lint PHP & PHP Compatibility checks." check though?

Yeah thats definately the intention behind the many phpcs PRs over the last releases/months.
The update to level 5 (https://github.com/WordPress/two-factor/pull/948/changes#diff-a4ce6ffd8cb697aecebba7af3c784ed29078f645544c069ec7fecbe9417e2a04R4) and enforcing in checks will help keep this level for new PRs

Also, what's the "Aufgabenliste aktualisiert" bit in the PR description?

Thanks, updated it. No need for the german text, sorry!