chore(2meet-data-optimizer): address the 2.1 audit notes

- The four public REST routes say why they are public (viewable posts only, show_in_rest fields only, per_page cap, one view per IP per post per hour).
- Admin ternary echoes of literal strings are escaped for their context: esc_attr() in attributes, esc_html() for text; the object-cache badge is an if/else and aria-current is always printed ("false" off the current tab).
- Exceptions in the migration engine and the health cron go to TMDO_Logger instead of error_log().
- Verify: audit greps (ternary echoes 23 → 0, error_log outside the logger 0); dev36 renders 8 admin tabs with the change, no PHP notice, one aria-current="page" each.
- PR: PR-078

admin/class-tmdo-admin.php

@@ -846,8 +846,8 @@ class TMDO_Admin {
 						<span class="wpdo-tab-group-label" aria-hidden="true"><?php echo esc_html( $group['label'] ); ?></span>
 						<?php foreach ( $group_tabs as $slug ) : ?>
 							<a href="<?php echo esc_url( add_query_arg( 'tab', $slug, admin_url( 'tools.php?page=' . self::MENU_SLUG ) ) ); ?>"
-								class="nav-tab <?php echo $tab === $slug ? 'nav-tab-active' : ''; ?>"
-								<?php echo $tab === $slug ? 'aria-current="page"' : ''; ?>>
+								class="nav-tab <?php echo esc_attr( $tab === $slug ? 'nav-tab-active' : '' ); ?>"
+								aria-current="<?php echo esc_attr( $tab === $slug ? 'page' : 'false' ); ?>">
 								<?php echo esc_html( $tabs[ $slug ] ); ?>
 								<?php if ( isset( $needs_dot[ $slug ] ) ) : ?>
 									<span class="wpdo-tab-dot" title="
@@ -1099,7 +1099,7 @@ class TMDO_Admin {
 					<tbody>
 						<tr>
 							<th><?php esc_html_e( '資料庫引擎', '2meet-data-optimizer' ); ?></th>
-							<td><code><?php echo TMDO_IS_MYSQL ? 'MySQL' : 'SQLite'; ?></code></td>
+							<td><code><?php echo esc_html( TMDO_IS_MYSQL ? 'MySQL' : 'SQLite' ); ?></code></td>
 						</tr>
 						<tr>
 							<th><?php esc_html_e( '外掛版本', '2meet-data-optimizer' ); ?></th>
@@ -1116,7 +1116,11 @@ class TMDO_Admin {
 						<tr>
 							<th><?php esc_html_e( 'Object Cache', '2meet-data-optimizer' ); ?></th>
 							<td>
-								<?php echo wp_using_ext_object_cache() ? '<span class="wpdo-badge wpdo-badge-ok">External</span>' : '<span class="wpdo-badge">Built-in</span>'; ?>
+								<?php if ( wp_using_ext_object_cache() ) : ?>
+									<span class="wpdo-badge wpdo-badge-ok">External</span>
+								<?php else : ?>
+									<span class="wpdo-badge">Built-in</span>
+								<?php endif; ?>
 								<?php if ( $cache['flush_support'] ) : ?>
 									<span class="wpdo-badge wpdo-badge-ok">Flush Support</span>
 								<?php endif; ?>
@@ -1726,13 +1730,13 @@ class TMDO_Admin {
 						↑ <?php esc_html_e( '升級模式', '2meet-data-optimizer' ); ?>
 					</button>
 					<button type="button"
-						class="button wpdo-btn-demote <?php echo $prev_mode ? '' : 'wpdo-eb-btn-dim'; ?>"
+						class="button wpdo-btn-demote <?php echo esc_attr( $prev_mode ? '' : 'wpdo-eb-btn-dim' ); ?>"
 						data-wpdo-action="demote"
 						data-entity-type="<?php echo esc_attr( $etype ); ?>"
 						data-prev-mode="<?php echo esc_attr( $prev_mode ?? '' ); ?>"
 						<?php disabled( ! $prev_mode ); ?>
 						title="<?php echo esc_attr( $prev_mode ? '降級到 ' . $prev_mode : '已在最低模式' ); ?>"
-						class="<?php echo $prev_mode ? '' : 'wpdo-eb-btn-dim'; ?>">
+						class="<?php echo esc_attr( $prev_mode ? '' : 'wpdo-eb-btn-dim' ); ?>">
 						↓ <?php esc_html_e( '降級模式', '2meet-data-optimizer' ); ?>
 					</button>
 				</div>
@@ -2037,7 +2041,7 @@ class TMDO_Admin {
 			</div>
 
 			<!-- Progress section (live) -->
-			<div id="wpdo-st-progress-card" class="wpdo-eb-card wpdo-mt-3<?php echo $is_running ? '' : ' wpdo-hidden'; ?>">
+			<div id="wpdo-st-progress-card" class="wpdo-eb-card wpdo-mt-3<?php echo esc_attr( $is_running ? '' : ' wpdo-hidden' ); ?>">
 				<h3 class="wpdo-mt-0"><?php esc_html_e( '2. 即時進度', '2meet-data-optimizer' ); ?></h3>
 				<div class="wpdo-bar-section">
 					<div class="wpdo-bar-header">
@@ -2071,7 +2075,7 @@ class TMDO_Admin {
 			</div>
 
 			<!-- Benchmark report -->
-			<div id="wpdo-st-bench-card" class="wpdo-eb-card wpdo-mt-3<?php echo ! empty( $state['benchmark'] ) ? '' : ' wpdo-hidden'; ?>">
+			<div id="wpdo-st-bench-card" class="wpdo-eb-card wpdo-mt-3<?php echo esc_attr( ! empty( $state['benchmark'] ) ? '' : ' wpdo-hidden' ); ?>">
 				<h3 class="wpdo-mt-0"><?php esc_html_e( '3. Benchmark 報告', '2meet-data-optimizer' ); ?></h3>
 				<div id="wpdo-st-bench-content">
 					<?php if ( ! empty( $state['benchmark'] ) ) : ?>