feat: support password credentials for site URL recovery

[soulteary]

Summary

• add WORDPRESS_SITE_URL_UPDATE_PASSWORD as a direct password option for /tool-update-site-url.php
• keep WORDPRESS_SITE_URL_UPDATE_TOKEN_FILE as the preferred Docker-secret option and retain direct WORDPRESS_SITE_URL_UPDATE_TOKEN compatibility
• require exactly one credential source to avoid ambiguous authentication precedence
• enforce source-specific minimum lengths: 32 characters for Token/TOKEN_FILE and 16 characters for PASSWORD
• update the recovery form, README, changelog, and security guidance from Token-only wording to credential wording
• document that direct Token/PASSWORD values are visible in container environment metadata
• add an image-smoke assertion that boots the bundled SQLite Database Integration v3 driver and exercises beginTransaction(), inTransaction(), and rollBack() on the exact object returned by $wpdb->get_driver()

Configuration

The endpoint still requires the explicit enable switch:

environment:
  WORDPRESS_SITE_URL_UPDATE_TOOL_ENABLED: "true"
  WORDPRESS_SITE_URL_UPDATE_PASSWORD: "a-strong-password-at-least-16-characters"

Use only one of:

• WORDPRESS_SITE_URL_UPDATE_TOKEN_FILE
• WORDPRESS_SITE_URL_UPDATE_TOKEN
• WORDPRESS_SITE_URL_UPDATE_PASSWORD

Validation

• PHP syntax checks for every PHP file
• php tests/test-tool-update-site-url.php
• PASSWORD minimum-length and authentication checks
• TOKEN_FILE + PASSWORD and TOKEN + PASSWORD conflict rejection
• all repository shell tests
• ShellCheck 0.11.0
• actionlint 1.7.12
• ./scripts/validate-release.sh 7.1.0
• git diff --check

The CI image-smoke job performs the final transaction-API check in the built WordPress PHP 8.5 image.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T17:06:58.269943Z	e6b932b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6b932b69d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".